apiVersion: v1
items:
- apiVersion: kuadrant.io/v1
  kind: AuthPolicy
  metadata:
    creationTimestamp: "2026-11-01T20:03:36Z"
    generation: 184
    labels:
      app.kubernetes.io/component: gateway-auth
      app.kubernetes.io/managed-by: maas-controller
      app.kubernetes.io/part-of: maas-gateway-auth
    name: maas-gateway-auth
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: gateway.networking.k8s.io/v1
      controller: true
      kind: Gateway
      name: maas-default-gateway
      uid: 2b0128c3-4574-431f-8fe0-70341b68b172
    resourceVersion: "168215"
    uid: 537958cc-e504-4dc5-a19a-b05fbba92744
  spec:
    defaults:
      rules:
        authentication:
          api-keys:
            metrics: false
            plain:
              selector: request.headers.authorization
            priority: 0
            when:
            - operator: matches
              selector: request.headers.authorization
              value: ^Bearer ****
          openshift-identities:
            kubernetesTokenReview:
              audiences:
              - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/a3bac
            metrics: false
            priority: 2
        authorization:
          auth-valid:
            cache:
              key:
                selector: '"api-key|" + (request.headers.authorization.replace("Bearer
                  ", "")) + "|" + (size(request.path.split("/").filter(x, x != ""))
                  >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" &&
                  request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x,
                  x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: |-
                allow {
                  object.get(input.auth.metadata, "apiKeyValidation", {})
                  input.auth.metadata.apiKeyValidation.valid == true
                }
                allow {
                  not input.auth.metadata.apiKeyValidation
                }
            priority: 0
          deny-api-key-management:
            metrics: false
            patternMatching:
              patterns:
              - predicate: "false"
            priority: 0
            when:
            - predicate: (request.headers.authorization.matches("^Bearer ****"))
                && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/"))
          deny-client-identity-headers:
            metrics: false
            patternMatching:
              patterns:
              - predicate: '!("x-maas-username" in request.headers)'
              - predicate: '!("x-maas-group" in request.headers)'
              - predicate: '!("x-maas-keyname" in request.headers)'
              - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)'
              - predicate: '!("x-maas-organization-id" in request.headers)'
              - predicate: '!("x-maas-cost-center" in request.headers)'
              - predicate: '!("x-maas-identity" in request.headers)'
              - predicate: '!("x-maas-admin-scope" in request.headers)'
              - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-"))
              - predicate: request.headers.all(name, !name.startsWith("x-grid-"))
            priority: 0
          guardrail-checks-known:
            metrics: false
            opa:
              allValues: false
              rego: |
                import future.keywords.every

                allow {
                  selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null)
                  selected != null
                  every id, value in selected {
                    id in []
                    value == true
                  }
                }
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
          require-group-membership:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: |-
                allow {
                  object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true
                }
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
          subscription-valid:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"],
                \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"deletionTimestamp\", \"\") == \"\"\n}"
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
        metadata:
          apiKeyValidation:
            cache:
              key:
                selector: auth.identity.replace("Bearer ", "")
              ttl: 60
            http:
              body:
                expression: '{"key": auth.identity.replace("Bearer ", "")}'
              contentType: application/json
              method: POST
              url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate
            metrics: false
            priority: 0
            when:
            - predicate: auth.identity.matches("^(Bearer ****")
          subscription-info:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            http:
              body:
                expression: |-
                  {
                    "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),
                    "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),
                    "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""),
                    "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   : ""))
                  }
              contentType: application/json
              method: POST
              url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select
            metrics: false
            priority: 1
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
        response:
          success:
            filters:
              identity:
                json:
                  properties:
                    groups:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                        ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                        : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                        : []))'
                    groups_str:
                      expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                        ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                        : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                        : []))).join(",")'
                    keyId:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.keyId : ""'
                    keyName:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.keyName : ""'
                    selected_subscription:
                      expression: 'has(auth.metadata["subscription-info"].name) ?
                        auth.metadata["subscription-info"].name : ""'
                    selected_subscription_id:
                      expression: 'has(auth.metadata["subscription-info"].rateLimitId)
                        ? auth.metadata["subscription-info"].rateLimitId : ""'
                    selected_subscription_key:
                      expression: '(has(auth.metadata["subscription-info"].namespace)
                        && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace
                        + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel)
                        && auth.metadata["subscription-info"].resolvedModel != ""
                        ? auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x,
                        x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0]
                        != "v1" && request.path.split("/").filter(x, x != "")[0] !=
                        "maas-api" ? request.path.split("/").filter(x, x != "")[0]
                        + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                        in request.headers   ? request.headers["x-gateway-model-name"]   :
                        ""))) : ""'
                    subscription_error:
                      expression: 'has(auth.metadata["subscription-info"].error) ?
                        auth.metadata["subscription-info"].error : ""'
                    subscription_error_message:
                      expression: 'has(auth.metadata["subscription-info"].message)
                        ? auth.metadata["subscription-info"].message : ""'
                    subscription_info:
                      expression: 'has(auth.metadata["subscription-info"].name) ?
                        auth.metadata["subscription-info"] : {}'
                    userid:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username)
                        ? auth.identity.preferred_username : (has(auth.identity.sub)
                        ? auth.identity.sub : auth.identity.user.username))'
                metrics: true
                priority: 0
                when:
                - predicate: (size(request.path.split("/").filter(x, x != "")) >=
                    2 && request.path.split("/").filter(x, x != "")[0] != "v1" &&
                    request.path.split("/").filter(x, x != "")[0] != "maas-api" ||
                    "x-gateway-model-name" in request.headers)
            headers:
              X-MaaS-Cost-Center:
                metrics: false
                plain:
                  expression: auth.metadata["subscription-info"].costCenter
                priority: 0
                when:
                - predicate: has(auth.metadata["subscription-info"].costCenter) &&
                    auth.metadata["subscription-info"].costCenter != ""
              X-MaaS-Group:
                metrics: false
                plain:
                  expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["''
                    + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]''
                    : ''[]'''
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Group-Token:
                key: X-MaaS-Group
                metrics: false
                plain:
                  expression: 'has(auth.identity.iss) ? (has(auth.identity.groups)
                    && size(auth.identity.groups) > 0 && auth.identity.groups.all(g,
                    g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","''
                    + auth.identity.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')
                    : (has(auth.identity.user.groups) && size(auth.identity.user.groups)
                    > 0 && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                    -]+$'')) ? ''["system:authenticated","'' + auth.identity.user.groups.join(''","'')
                    + ''"]'' : ''["system:authenticated"]'')'
                priority: 1
                when:
                - predicate: '!request.headers.authorization.startsWith("Bearer ****")'
              X-MaaS-Identity:
                json:
                  properties:
                    claims:
                      expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub,
                        "aud": auth.identity.aud, "azp": auth.identity.azp, "name":
                        has(auth.identity.name) ? auth.identity.name : "", "given_name":
                        has(auth.identity.given_name) ? auth.identity.given_name :
                        "", "family_name": has(auth.identity.family_name) ? auth.identity.family_name
                        : "", "preferred_username": has(auth.identity.preferred_username)
                        ? auth.identity.preferred_username : "", "email": has(auth.identity.email)
                        ? auth.identity.email : "", "groups": has(auth.identity.groups)
                        ? auth.identity.groups : [], "https://redhat.com/maas/orgs":
                        "https://redhat.com/maas/orgs" in auth.identity ? auth.identity["https://redhat.com/maas/orgs"]
                        : []}'
                    source:
                      value: oidc
                metrics: false
                priority: 0
                when:
                - predicate: "false"
              X-MaaS-KeyName:
                key: x-maas-keyname
                metrics: false
                plain:
                  expression: auth.metadata.apiKeyValidation.keyName
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Subscription:
                metrics: false
                plain:
                  expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                    ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                    in request.headers ? request.headers["x-maas-subscription"] :
                    "")'
                priority: 0
                when:
                - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation)
                    && auth.metadata.apiKeyValidation.subscription != ""
              X-MaaS-Subscription-Rate-Limit-Id:
                metrics: false
                plain:
                  expression: auth.metadata["subscription-info"].rateLimitId
                priority: 0
                when:
                - predicate: has(auth.metadata["subscription-info"].rateLimitId) &&
                    auth.metadata["subscription-info"].rateLimitId != ""
              X-MaaS-Username:
                metrics: false
                plain:
                  selector: auth.metadata.apiKeyValidation.username
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Username-Token:
                key: X-MaaS-Username
                metrics: false
                plain:
                  expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username
                    : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)'
                priority: 1
                when:
                - predicate: '!request.headers.authorization.startsWith("Bearer ****")'
              x-gateway-inference-fairness-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                    : ""'
                priority: 0
              x-gateway-inference-objective:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                    : ""'
                priority: 0
              x-llm-d-inference-fairness-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                    : ""'
                priority: 0
              x-llm-d-inference-objective:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                    : ""'
                priority: 0
              x-maas-organization-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId
                    : ""'
                priority: 0
          unauthenticated:
            body:
              value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}'
            code: 401
            headers:
              content-type:
                value: application/json
            message:
              value: Authentication required
          unauthorized:
            body:
              expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message)
                ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'',
                ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'',
                ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}'''
            code: 403
            headers:
              content-type:
                value: application/json
              x-ext-auth-reason:
                expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
                  : "unauthorized"'
      strategy: atomic
      when:
      - predicate: request.path != "/maas-api/health" || request.method != "GET"
    targetRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: maas-default-gateway
  status:
    conditions:
    - lastTransitionTime: "2026-11-01T20:03:36Z"
      message: AuthPolicy has been accepted
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2026-11-01T21:00:46Z"
      message: 'AuthPolicy waiting for the following components to sync: [AuthConfig
        (a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14) AuthConfig
        (135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a) AuthConfig
        (3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a) AuthConfig
        (726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f) AuthConfig
        (7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f) AuthConfig
        (d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1) AuthConfig
        (efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce) AuthConfig
        (4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33) AuthConfig
        (b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668) AuthConfig
        (6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3) AuthConfig
        (3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c) AuthConfig
        (a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269) AuthConfig
        (54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0) AuthConfig
        (596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398) AuthConfig
        (3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c) AuthConfig
        (aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04) AuthConfig
        (5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02) AuthConfig
        (99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de) AuthConfig
        (ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b) AuthConfig
        (9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef) AuthConfig
        (06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc) AuthConfig
        (a9800464506c58f005016df354e160757732171ff4d19747202524955329b998) AuthConfig
        (de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb) AuthConfig
        (8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045) AuthConfig
        (98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57) AuthConfig
        (06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3) AuthConfig
        (d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688) AuthConfig
        (0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f)]'
      reason: Unknown
      status: "False"
      type: Enforced
    observedGeneration: 184
- apiVersion: kuadrant.io/v1
  kind: AuthPolicy
  metadata:
    creationTimestamp: "2026-11-01T20:03:02Z"
    generation: 1
    labels:
      app.kubernetes.io/component: llminferenceservice-policies
      app.kubernetes.io/managed-by: odh-model-controller
      app.kubernetes.io/name: llminferenceservice-auth
      app.kubernetes.io/part-of: llminferenceservice
    name: openshift-ai-inference-authn
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: gateway.networking.k8s.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: Gateway
      name: openshift-ai-inference
      uid: 5fbf1db6-d274-4c52-9acc-34176e43eeda
    resourceVersion: "17195"
    uid: 1f64e541-c0dc-4669-bdc1-fe71aa2257ce
  spec:
    patterns:
      has-ns-and-name:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/[^/]+/[^/]+
      is-publisher-path:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/publishers/[^/]+/models/
    rules:
      authentication:
        kubernetes-user:
          credentials: ****REDACTED****
          kubernetesTokenReview:
            audiences:
            - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/a3bac
          metrics: false
          overrides:
            fairness:
              value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/a3bac
            objective:
              expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                ? auth.identity.user.username.split('':'')[2] : ''authenticated'''
            resolvedGroups:
              expression: |-
                'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers
                  ? request.headers['x-maas-groups'].split(',')
                  : [])
                : auth.identity.user.groups
            resolvedUser:
              expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user'']
                : auth.identity.user.username'
          priority: 0
      authorization:
        deny-misrouted-model-header:
          metrics: false
          patternMatching:
            patterns:
            - predicate: "false"
          priority: 0
          when:
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'')
              || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))'
          - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')'
        inference-access:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices
              subresource: {}
              verb:
                value: get
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
        inference-access-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '''x-maas-user'' in request.headers'
        model-access-path:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models
              subresource: {}
              verb:
                value: post
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
        model-access-path-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
          - predicate: '''x-maas-user'' in request.headers'
      response:
        success:
          headers:
            x-gateway-inference-fairness-id:
              metrics: false
              plain:
                expression: auth.identity.fairness
              priority: 0
            x-gateway-inference-objective:
              metrics: false
              plain:
                expression: auth.identity.objective
              priority: 0
            x-maas-groups:
              metrics: false
              plain:
                expression: auth.identity.user.groups.join(',')
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-maas-user:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-tenant-id:
              metrics: false
              plain:
                expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                  ? auth.identity.user.username.split('':'')[2] : ''default'''
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
            x-user-id:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
    targetRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: openshift-ai-inference
  status:
    conditions:
    - lastTransitionTime: "2026-11-01T20:03:02Z"
      message: AuthPolicy has been accepted
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2026-11-01T20:03:02Z"
      message: AuthPolicy is not in the path to any existing routes
      reason: Unknown
      status: "False"
      type: Enforced
    observedGeneration: 1
kind: List
metadata:
  resourceVersion: ""