{"level":"info","ts":"2026-07-14T17:02:02.727Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:02.939Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:05.432Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","TokenRateLimitPolicy","Gateway","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":16,"update":7}}
{"level":"info","ts":"2026-07-14T17:02:05.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:05.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:05.626Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:05.626Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:06.230Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:06.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:06.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:06.339Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:06.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:06.434Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:02:06.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:08.335Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:08.733Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:08.928Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-07-14T17:02:09.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:09.737Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:09.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:09.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:10.133Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:02:10.228Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:02:10.228Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:02:10.228Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:02:10.228Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.339Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.627Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-584665","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:08Z","generation":10,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a095783a-1abb-480e-be5d-1c84854d3564\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:01:58Z"}],"name":"kuadrant-e2e-shared-a-584665","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-584665","uid":"a095783a-1abb-480e-be5d-1c84854d3564"}],"resourceVersion":"53266","uid":"30d900ab-e76e-4182-ad3f-8d4d4850fba6"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"96978a61d0eaee44e51498405660449673d9eea5b2b407546fc7aab55cfd5564","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"67dfce3813a9023a53ed2c7711e3b6e33cf95f14ab055b7363c934431c601a6a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"eb8fd685717015989b9b2e5fbba3a30c99d04257baaa6678604d00373c81e690","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"aa1883fb7a69567512a3e8f178294ef7283a3ea6bf915aeb659e5a8fad9695d1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"3a01393ebd11355e8e808aa202fbf517f2395fe313194373f1857c3dbd8ac47d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"0864827c792442e1761cb302545a00938d1c5a07703b80b56db9c688eac6cdb7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"44e948f41214466e48b6ff87b69323a45c4acc51bc5d0a0394e7562c12eaa7a3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"fbba0e59b8e7262a784bc0155f7e973d478f2a7ecf0e1f3c5b92439b51db6aea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"fd25ee5592d11ae6d7ccc411063318cb2d7fdf40f0ff8a1c2e632cfdad0bbc76","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"7bed500c75cdd50f3af7869eebe9bed121a0596e5c4b26da0f92ee307a0e5c97","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"25ac8047715f7759438c70723fc5c2c0cd13b91c03e8b052d83950ccd288f866","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"f6ac5f6541b365c640429931a6dffb4058183713ea9971d29d2fa573880ca5ab","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9ed96dc48a92d8c1f22bdff71d285ddf53e28bae88a059746efd56f9c0629491","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"e897b1a41dbd13c82b150aba4ae35bd2a92ab988d90ca63c40ebf5539ae8ebd6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"e0775ad7e6558aab67edbb6cc96d5a83929f07cb5277999815899c714713978f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-584665"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:02:10.643Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.751Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:10.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","httpRouteRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-584665/auth-test-model-584665\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-584665.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa\" already exists"}
{"level":"error","ts":"2026-07-14T17:02:11.437Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-584665-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-584665-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:02:11.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:02:11.539Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-584665-kserve-route","namespace":"ai-tenant-e2e-shared-a-584665","uid":"1235769e-212e-42c0-b59b-36e24937d854","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-584665-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:02:11.729Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:14.431Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","WasmPlugin","Limitador","AuthPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"create":8,"update":5}}
{"level":"info","ts":"2026-07-14T17:02:14.443Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:14.528Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:14.727Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:14.727Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:15.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:15.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:15.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:15.437Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:16.034Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:16.134Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:02:16.134Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:17.471Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:17.836Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:19.330Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-14T17:02:19.344Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:19.630Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:19.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:19.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:20.037Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:20.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:20.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:20.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:20.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:02:20.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:20.530Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:21.863Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:22.139Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:29.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-14T17:02:30.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:30.232Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:30.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:02:30.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:30.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:30.928Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:31.032Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:32.977Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:33.332Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:36.340Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","WasmPlugin","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","ConfigMap"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-14T17:02:36.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:36.450Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:36.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:36.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:37.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:37.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:37.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:37.531Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:37.629Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:02:37.629Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:37.635Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:39.349Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:39.928Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:41.327Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-14T17:02:41.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:41.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:42.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:42.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:42.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:42.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:42.437Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:42.733Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:43.130Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:43.230Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:02:43.230Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:02:44.236Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-314eb4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-314eb4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:02:44.442Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-584665-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-584665-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:02:44.941Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:45.536Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:48.434Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-07-14T17:02:49.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:49.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:02:49.731Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:49.731Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:49.731Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:49.926Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:57.241Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","HTTPRoute","WasmPlugin","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-14T17:02:57.254Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:57.426Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:02:57.526Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:02:57.526Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:58.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:58.331Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:02:58.526Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:02:58.526Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-14T17:02:58.537Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:02:58.537Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:02:58.930Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:02:59.236Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:00.966Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:01.533Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:01.738Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":2,"delete":2}}
{"level":"info","ts":"2026-07-14T17:03:02.529Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:02.529Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:02.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:02.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:03:02.737Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:02.737Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:03:02.946Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-314eb4","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:15Z","generation":16,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"faa69fdb-5358-4c0e-b78a-362ac657e448\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:02:50Z"}],"name":"kuadrant-e2e-shared-b-314eb4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-314eb4","uid":"faa69fdb-5358-4c0e-b78a-362ac657e448"}],"resourceVersion":"54167","uid":"bce4cc00-5de0-4da4-b301-837cf3766a49"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"434f5fe53b42331042bf0068309dc4520aa771c1ebbdf341d4244a4a9791cd13","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"fd2e190038228590eecb58a182701420a104459963a4aed1a3da9dca3fb52742","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"434f5fe53b42331042bf0068309dc4520aa771c1ebbdf341d4244a4a9791cd13","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"1603b0f1d03d67795d586e46ca22464b93a847ff1de94b6c3ee769dd113aee38","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8fbfd188a91ba33e508ddd27efac7be35c32311a36634bba3ac13aa9950dc5f6","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"7fb93ec4a8e65b2f915b9ce22a8f9a71061040530497a4b58b468cf8f3e65f21","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8fbfd188a91ba33e508ddd27efac7be35c32311a36634bba3ac13aa9950dc5f6","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"dfca7b52768005d980f917c8cca2e17390366bba9ac04840fa4301b5c1098710","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e63de12030b7256911cc676545df9ada12de11e848649a442f1584930f506815","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"dfeeb7d2cf42c627f3fdf1af69e6fa3ca16f0ea86446b5ce7c8b97fe32e103f3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e63de12030b7256911cc676545df9ada12de11e848649a442f1584930f506815","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"4486c79a0128392f1e8693bb7a1ca8bdaf8f90710b77f43e7f09e89d4912cffe","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"78e3b6d9aa4274d2b4801ad8e141319ec8d608b7b7e151ed2b418f177f2c9edd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"74b2091b05b3157430292e3a99ac865c9f8dbe700664b6bcc025a46cbe68c862","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"59d84cc4b40a72a9d968ff24270a67b2086c81865d4e261c48917094970a2f7b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"24de359c17fabeb0744440c39ca803ce00e400bc1a5b5d8e8dfaecbb6b64eb52","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"884a00dfebef5c8f9903103f30f4d840627525b80cdf12c3f4fdc30997014e75","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"3c7bcba7d96003633b5a66ff32e138a283bcf11689ed65bdb38018cce1bdaef7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9f3c38e506618fc2e786750bb2a944444b23399c05cc89f4cd4f65bf5ce82829","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"63884fc78093fb1981bff0ddf494730e77035227f93109b19c18370de0583a8f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d0fecafb5f3a1b923399052760206c7edd6304a856ea01e37e8f15aaf27c55d2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"287d18edf4379a1cc0fc32a2018f9054f45a7e47423de5af35b3784b0991c39a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d24a018a03d203a84c0bceae432fc2577d7c041b0471b014c8857be3c3986ead","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"9421acc5bfbea97f23bf1d43d0995425e6f7d18994e8129c80bfb1aa91eca2a5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9f3d5881a5519bf8532a3c1acbace050714b6091ad22bea08fb884a5f229c27e","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_shared_sub_4e3f46_sub_test_model_314eb4_tokens__433595db","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_314eb4_e2e_b_only_4e3f46_sub_test_model_314eb4_tokens__faa40002","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-314eb4/e2e-b-only-4e3f46@ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/sub-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-314eb4/maas-trlp-sub-test-model-314eb4"]}],"name":"d631b0b623832a4f4b2e8934982a191f2642c87b82e833d6f4ddd10b2c7cfa27","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-314eb4"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:03.343Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-584665","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:08Z","generation":12,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a095783a-1abb-480e-be5d-1c84854d3564\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:02:50Z"}],"name":"kuadrant-e2e-shared-a-584665","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-584665","uid":"a095783a-1abb-480e-be5d-1c84854d3564"}],"resourceVersion":"54177","uid":"30d900ab-e76e-4182-ad3f-8d4d4850fba6"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"96978a61d0eaee44e51498405660449673d9eea5b2b407546fc7aab55cfd5564","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"67dfce3813a9023a53ed2c7711e3b6e33cf95f14ab055b7363c934431c601a6a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"eb8fd685717015989b9b2e5fbba3a30c99d04257baaa6678604d00373c81e690","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"aa1883fb7a69567512a3e8f178294ef7283a3ea6bf915aeb659e5a8fad9695d1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"3a01393ebd11355e8e808aa202fbf517f2395fe313194373f1857c3dbd8ac47d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"0864827c792442e1761cb302545a00938d1c5a07703b80b56db9c688eac6cdb7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"44e948f41214466e48b6ff87b69323a45c4acc51bc5d0a0394e7562c12eaa7a3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"fbba0e59b8e7262a784bc0155f7e973d478f2a7ecf0e1f3c5b92439b51db6aea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"fd25ee5592d11ae6d7ccc411063318cb2d7fdf40f0ff8a1c2e632cfdad0bbc76","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"7bed500c75cdd50f3af7869eebe9bed121a0596e5c4b26da0f92ee307a0e5c97","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/sub-test-model-584665')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"25ac8047715f7759438c70723fc5c2c0cd13b91c03e8b052d83950ccd288f866","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"f6ac5f6541b365c640429931a6dffb4058183713ea9971d29d2fa573880ca5ab","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9ed96dc48a92d8c1f22bdff71d285ddf53e28bae88a059746efd56f9c0629491","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"e897b1a41dbd13c82b150aba4ae35bd2a92ab988d90ca63c40ebf5539ae8ebd6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_shared_sub_4e3f46_sub_test_model_584665_tokens__f79deb9c","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-shared-sub-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_584665_e2e_a_only_4e3f46_sub_test_model_584665_tokens__bd7282b3","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-584665/e2e-a-only-4e3f46@ai-tenant-e2e-shared-a-584665/sub-test-model-584665\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/sub-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-584665/maas-trlp-sub-test-model-584665"]}],"name":"e0775ad7e6558aab67edbb6cc96d5a83929f07cb5277999815899c714713978f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-584665"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:03.435Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-584665","namespace":"ai-tenant-e2e-shared-a-584665","uid":"2ba3b916-8b4d-4d0d-a1b7-3972c3a45c3e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-584665\" not found"}
{"level":"error","ts":"2026-07-14T17:03:03.640Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-314eb4","namespace":"ai-tenant-e2e-shared-b-314eb4","uid":"97c85d7d-ba1d-4dc8-a3e4-c19471b03b59","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-314eb4\" not found"}
{"level":"error","ts":"2026-07-14T17:03:04.235Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-584665","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:07.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway","Limitador","WasmPlugin","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":8}}
{"level":"info","ts":"2026-07-14T17:03:07.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:07.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:07.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:07.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:07.934Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:07.934Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:08.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:08.135Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:08.228Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:03:08.229Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:08.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:09.845Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:10.039Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:10.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-07-14T17:03:10.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:11.132Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:11.132Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:11.132Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-14T17:03:11.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16","error":"authconfigs.authorino.kuadrant.io \"6b4ad1dce4247319bb8c15a6afef3c9573e73901ad4892e91e09ede1d5e24f16\" not found"}
{"level":"info","ts":"2026-07-14T17:03:11.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:03:11.427Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:03:11.427Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/59d84cc4b40a72a9d968ff24270a67b2086c81865d4e261c48917094970a2f7b","error":"authconfigs.authorino.kuadrant.io \"59d84cc4b40a72a9d968ff24270a67b2086c81865d4e261c48917094970a2f7b\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.427Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:11.427Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:03:11.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa","error":"authconfigs.authorino.kuadrant.io \"c0276724848b8aa5aefa4247998ed959313a3b3358f02d69543aaf85e82810fa\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.435Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3","error":"authconfigs.authorino.kuadrant.io \"be24c3366f0f8d5f4d640e96d4a6b4cd77f33bd89935bb344b1b9d6ffbdd62f3\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/434f5fe53b42331042bf0068309dc4520aa771c1ebbdf341d4244a4a9791cd13","error":"authconfigs.authorino.kuadrant.io \"434f5fe53b42331042bf0068309dc4520aa771c1ebbdf341d4244a4a9791cd13\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d","error":"authconfigs.authorino.kuadrant.io \"7d8f10a38411912d70ffc81ca75ff1d36a0d6bd73f9ac0c4e308acbaa6189f7d\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310","error":"authconfigs.authorino.kuadrant.io \"0cb91da091860e3cb992a6e2183d55ed6b530c2123022ed167dc3dba77fc9310\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8fbfd188a91ba33e508ddd27efac7be35c32311a36634bba3ac13aa9950dc5f6","error":"authconfigs.authorino.kuadrant.io \"8fbfd188a91ba33e508ddd27efac7be35c32311a36634bba3ac13aa9950dc5f6\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.526Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/884a00dfebef5c8f9903103f30f4d840627525b80cdf12c3f4fdc30997014e75","error":"authconfigs.authorino.kuadrant.io \"884a00dfebef5c8f9903103f30f4d840627525b80cdf12c3f4fdc30997014e75\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.530Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff","error":"authconfigs.authorino.kuadrant.io \"d40dd522f2ab6971d6a0d3486e6b386aaded8e1c9b0a94b63d49712356657dff\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.535Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9f3d5881a5519bf8532a3c1acbace050714b6091ad22bea08fb884a5f229c27e","error":"authconfigs.authorino.kuadrant.io \"9f3d5881a5519bf8532a3c1acbace050714b6091ad22bea08fb884a5f229c27e\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.538Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0","error":"authconfigs.authorino.kuadrant.io \"ba234840fa5ed25a693a8e171a1d6151868121e3b5ffbaba5f828333741578b0\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/78e3b6d9aa4274d2b4801ad8e141319ec8d608b7b7e151ed2b418f177f2c9edd","error":"authconfigs.authorino.kuadrant.io \"78e3b6d9aa4274d2b4801ad8e141319ec8d608b7b7e151ed2b418f177f2c9edd\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.544Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9f3c38e506618fc2e786750bb2a944444b23399c05cc89f4cd4f65bf5ce82829","error":"authconfigs.authorino.kuadrant.io \"9f3c38e506618fc2e786750bb2a944444b23399c05cc89f4cd4f65bf5ce82829\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e63de12030b7256911cc676545df9ada12de11e848649a442f1584930f506815","error":"authconfigs.authorino.kuadrant.io \"e63de12030b7256911cc676545df9ada12de11e848649a442f1584930f506815\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.547Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-314eb4","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:15Z","generation":17,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"faa69fdb-5358-4c0e-b78a-362ac657e448\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:02:59Z"}],"name":"kuadrant-e2e-shared-b-314eb4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-314eb4","uid":"faa69fdb-5358-4c0e-b78a-362ac657e448"}],"resourceVersion":"54348","uid":"bce4cc00-5de0-4da4-b301-837cf3766a49"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d0fecafb5f3a1b923399052760206c7edd6304a856ea01e37e8f15aaf27c55d2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"287d18edf4379a1cc0fc32a2018f9054f45a7e47423de5af35b3784b0991c39a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d24a018a03d203a84c0bceae432fc2577d7c041b0471b014c8857be3c3986ead","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"9421acc5bfbea97f23bf1d43d0995425e6f7d18994e8129c80bfb1aa91eca2a5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-314eb4"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:11.550Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f","error":"authconfigs.authorino.kuadrant.io \"4fa263e1537287751f8b37cb3cf0fd551a93f56b0fb0cc6df2a293dbcaa4106f\" not found"}
{"level":"error","ts":"2026-07-14T17:03:11.635Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-584665","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:08Z","generation":13,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a095783a-1abb-480e-be5d-1c84854d3564\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:02:59Z"}],"name":"kuadrant-e2e-shared-a-584665","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-584665","uid":"a095783a-1abb-480e-be5d-1c84854d3564"}],"resourceVersion":"54349","uid":"30d900ab-e76e-4182-ad3f-8d4d4850fba6"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"25ac8047715f7759438c70723fc5c2c0cd13b91c03e8b052d83950ccd288f866","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"f6ac5f6541b365c640429931a6dffb4058183713ea9971d29d2fa573880ca5ab","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9ed96dc48a92d8c1f22bdff71d285ddf53e28bae88a059746efd56f9c0629491","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"e897b1a41dbd13c82b150aba4ae35bd2a92ab988d90ca63c40ebf5539ae8ebd6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-584665"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:11.838Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-314eb4","namespace":"openshift-ingress","uid":"138e64d1-bd1a-4be3-8a9d-1b594448a119","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:12.652Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-584665","namespace":"openshift-ingress","uid":"e944aa63-0f3d-4504-8ad1-c9cffd7a68a6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:12.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:13.031Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:15.438Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","WasmPlugin","Gateway","TokenRateLimitPolicy","ConfigMap","HTTPRoute","AuthConfig"],"eventTypes":{"create":1,"delete":16,"update":7}}
{"level":"info","ts":"2026-07-14T17:03:15.450Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:15.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:15.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:15.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:16.240Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:16.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:16.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:16.334Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:16.731Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:16.831Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:03:17.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:17.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:18.455Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:18.734Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:21.534Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","WasmPlugin","Limitador","HTTPRoute","AuthPolicy"],"eventTypes":{"create":8,"update":5}}
{"level":"info","ts":"2026-07-14T17:03:21.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:21.629Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:21.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:21.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:22.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:22.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:22.326Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:22.335Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:03:22.430Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:22.435Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:22.533Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:23.847Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:24.130Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:25.535Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-07-14T17:03:25.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:26.026Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:26.228Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:26.228Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:26.432Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:26.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:03:26.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:26.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:26.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:26.635Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:26.730Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:28.452Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:28.935Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:30.231Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":15}}
{"level":"info","ts":"2026-07-14T17:03:30.245Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:30.528Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:30.727Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:30.727Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:30.928Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:30.928Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:31.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:31.034Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:31.128Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:03:31.128Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:32.186Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:32.441Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:36.030Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","ConfigMap","Gateway"],"eventTypes":{"create":1,"update":11}}
{"level":"info","ts":"2026-07-14T17:03:36.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:37.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:37.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:37.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:37.436Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:37.438Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:03:37.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:39.074Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:39.530Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:42.432Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","WasmPlugin","AuthConfig","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-14T17:03:42.446Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:42.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:42.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:42.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:43.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:43.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:43.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:43.629Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:43.731Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:03:43.731Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:43.929Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:45.466Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:46.041Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:47.442Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-14T17:03:47.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:47.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:03:47.927Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:03:47.927Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:48.429Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:48.429Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:48.429Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:48.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:49.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:03:49.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:49.126Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:03:49.642Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-314eb4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-314eb4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:03:50.229Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-584665-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-584665-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:03:50.556Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:51.131Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:54.134Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-07-14T17:03:55.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:55.026Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:03:55.134Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:03:55.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:03:55.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:03:55.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:01.036Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","TokenRateLimitPolicy","HTTPRoute","ConfigMap","WasmPlugin","AuthPolicy"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-14T17:04:01.140Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:01.150Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:01.327Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:01.327Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:02.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:02.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:02.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:02.137Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:04:02.137Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:02.333Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:02.339Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:04:03.139Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-314eb4","namespace":"ai-tenant-e2e-shared-b-314eb4","uid":"40abfe7b-719f-4790-a71d-d4bc5a0ae04d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-314eb4\" not found"}
{"level":"error","ts":"2026-07-14T17:04:04.142Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-584665","namespace":"ai-tenant-e2e-shared-a-584665","uid":"02960d50-0d4e-4f14-9fb3-2893ec87456f","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-584665\" not found"}
{"level":"info","ts":"2026-07-14T17:04:04.335Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:05.138Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:08.133Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","TokenRateLimitPolicy","Limitador"],"eventTypes":{"create":2,"delete":2,"update":6}}
{"level":"info","ts":"2026-07-14T17:04:08.147Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:08.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:08.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:08.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:09.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:09.129Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:09.137Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:04:09.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:09.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:09.427Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:09.529Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:11.178Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:11.834Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:16.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","ConfigMap","TokenRateLimitPolicy","Limitador"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-14T17:04:16.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:16.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:16.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:16.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:17.136Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:17.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:17.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:17.535Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:17.627Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:04:17.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:04:17.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:19.446Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:04:19.457Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-584665-kserve-route","namespace":"ai-tenant-e2e-shared-a-584665","uid":"78809955-04d3-44ad-95cb-42835ab0e99b","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-584665-kserve-route\" not found"}
{"level":"error","ts":"2026-07-14T17:04:19.531Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-584665","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:04:19.536Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-314eb4-kserve-route","namespace":"ai-tenant-e2e-shared-b-314eb4","uid":"0ac71bb9-c3d1-4961-89ed-1eb95460c7a5","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-314eb4-kserve-route\" not found"}
{"level":"info","ts":"2026-07-14T17:04:20.033Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:20.241Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-14T17:04:21.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:21.226Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:21.326Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:21.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:04:21.428Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:04:21.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:04:21.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:21.728Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:04:22.152Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-584665","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:08Z","generation":17,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a095783a-1abb-480e-be5d-1c84854d3564\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:04:10Z"}],"name":"kuadrant-e2e-shared-a-584665","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-584665","uid":"a095783a-1abb-480e-be5d-1c84854d3564"}],"resourceVersion":"55623","uid":"30d900ab-e76e-4182-ad3f-8d4d4850fba6"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"fc3ac402c4e7fe6d5d7e2c3cd601b36189f4aad4a5a0f4c493328264252fa4bd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"06a37858ed20bb3a39ec94b36629062946f604acf77664b32cfdd3032a2254bd","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"fc3ac402c4e7fe6d5d7e2c3cd601b36189f4aad4a5a0f4c493328264252fa4bd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"a0f8c6cc59e99c62af6dcda9834b05cf1064bf548dd377dea70f86fbc6f81192","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c910838f4d2797cb2afa6bf571c09f07ad1634103d07e9c7a6b7c02c8f02c0a7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"0ca970b119e5ef231320c673b78bb5eb8f4becd58e9c7d95a98fdf4585c8c616","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c910838f4d2797cb2afa6bf571c09f07ad1634103d07e9c7a6b7c02c8f02c0a7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"4e5c90464e625e14874ffa31de5d7c18adab082a7b973b66affffb8b784f26c6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6635dbd859ee6ae52a88f633041ef8f359f5d625a464c4c32ececb0f481315c3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"b6ffee4fe970a101f85511085cfeedc5ef3f2122f5b5ef2138d5f1b9958bca5b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6635dbd859ee6ae52a88f633041ef8f359f5d625a464c4c32ececb0f481315c3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"0ce26dd844b96d9845674a5d037fc6ae5fe98b25d0fa4b09ab3a9aeb4c3189b5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"00dc5f0c12a2ed50c29d84f7b8885cf4cb36cfc3dbeef7988219edadd6d03d37","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"f9469dc1471ecfed31e180c2dd31d8f94201fbc26c749c6d3fc2c20e8db0f3c7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/rate-test-model-584665/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5d3a33e6b197970136019cd81d84d9e34946a821fc27d489887b538bfbc5308a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"1b277d19782a02a8135500426d46982af31c0c3eb966aa8f64b88dec3f85b3a7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/rate-test-model-584665/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"14a9450bcbcf155d3e256af8c8f1125194b1e4ebac8b5066b0205d81613da8eb","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"c6effa30a20bc341bda2a6fe842c331e7831e38932d32ed93b0628014efdae01","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/rate-test-model-584665/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"18563a7612cbec4a8363064b9333d2afbb7ac95e1875b3e2ecd67c538125621b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"6ba9ecb2d77e91b68d5e104baf04a4e45057c768df0894ca6b39e5603b78c087","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-584665/rate-test-model-584665')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"25ac8047715f7759438c70723fc5c2c0cd13b91c03e8b052d83950ccd288f866","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"f6ac5f6541b365c640429931a6dffb4058183713ea9971d29d2fa573880ca5ab","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9ed96dc48a92d8c1f22bdff71d285ddf53e28bae88a059746efd56f9c0629491","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-584665-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"e897b1a41dbd13c82b150aba4ae35bd2a92ab988d90ca63c40ebf5539ae8ebd6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"80a2255e44520f3e53c9f6bc18b6915b7c499dcd42aa3dd0fa53a498da586a9c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-584665-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__50bec792","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-584665/rate-test-model-584665-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-584665"]}],"name":"50471e3ddb1d23f75ffb3cae82ef43d60f444e27dfcae0db3ca5c642f6203815","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-584665/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-584665"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:04:22.173Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-314eb4","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T16:59:15Z","generation":21,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"faa69fdb-5358-4c0e-b78a-362ac657e448\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:04:10Z"}],"name":"kuadrant-e2e-shared-b-314eb4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-314eb4","uid":"faa69fdb-5358-4c0e-b78a-362ac657e448"}],"resourceVersion":"55624","uid":"bce4cc00-5de0-4da4-b301-837cf3766a49"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"48c008a226361442033e224c2412bf720cd81020abe929433f30c1a8a5bbd8b8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"6f6c3a06fdfc7407075b3e8c6da54d2cc7d84d898d53a1d4fad1edce31fc4180","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"48c008a226361442033e224c2412bf720cd81020abe929433f30c1a8a5bbd8b8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"e58a61ed38eaa3d8fb6a3909e7212fc13000f06862fbfd4172628efaf9159210","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"87a2979e454aaeb5ea69a32995d165781dfce053904d58a633c2299b92f8bf5d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"f68dafc27131711342dc72b0e8711302ccf909ce32c48e7894682eee0d8f6543","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"87a2979e454aaeb5ea69a32995d165781dfce053904d58a633c2299b92f8bf5d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"cc59c71b4f9a957d4d616f8902efc70837d671cfecfe2978cc7d0a0953685ea3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"34f24aff54d13e17ef690ff92a6c38ff10525fbc3ec1a76030c64ae17ee016b9","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"0e32897ee041614558757d468920163d8b86dc2eea6b8e1363027933f5e5e512","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"34f24aff54d13e17ef690ff92a6c38ff10525fbc3ec1a76030c64ae17ee016b9","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"d1ffe93dc606c7f15635e6f53aea58583f63c15b09fbc928c36af5999c6d4f64","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"be7448d2e73123bb0afea46f7b58d1583668202d7872f8b58b21659e0e6caae5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"03f06899d0c8622fff03596a3330019654b7070e03b8fb0668684b81ec91f88e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6f54316113509a995f2e4dc87ea7995a49667a78f5b7d4acf4b80142f7ed0c1b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"6161b36c0e072b66bfd6ffd7377efffb4666781c623cc5192c0f02f09ab04563","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5a4be07c59df069ce61dd4c16f3d2900c4f52e16f38165dbb8b5812d9198992f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"552b64196b46c418e014d761cfed70be467d6bf39f4e024d232bf933f8161bbb","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8fd074f7892d473838af6b05790f470f1829bc8cf4359f5b818f21996e9b6f58","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"db4f6cc31eb0989df5937b38e3bbaafa02e0741f0a205646e6b490819301a700","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d0fecafb5f3a1b923399052760206c7edd6304a856ea01e37e8f15aaf27c55d2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"287d18edf4379a1cc0fc32a2018f9054f45a7e47423de5af35b3784b0991c39a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d24a018a03d203a84c0bceae432fc2577d7c041b0471b014c8857be3c3986ead","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-314eb4-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"9421acc5bfbea97f23bf1d43d0995425e6f7d18994e8129c80bfb1aa91eca2a5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"42e04e7603f56b670e4c63c0edcf3f16cff4878f130216d275f84e040580cc8f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-314eb4-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__22f1304f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-314eb4/rate-test-model-314eb4-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-314eb4"]}],"name":"e4ced122883f8a2c2edae3edbdc46aa3e85179dacf8476314512fe8f6b0863f9","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-314eb4/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-314eb4"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:04:22.732Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-314eb4","namespace":"openshift-ingress","uid":"138e64d1-bd1a-4be3-8a9d-1b594448a119","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:04:23.136Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-584665","namespace":"openshift-ingress","uid":"e944aa63-0f3d-4504-8ad1-c9cffd7a68a6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:04:23.136Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:04:23.226Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-584665-kserve-route","namespace":"ai-tenant-e2e-shared-a-584665","uid":"78809955-04d3-44ad-95cb-42835ab0e99b","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-584665-kserve-route\" not found"}
{"level":"error","ts":"2026-07-14T17:04:23.236Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-314eb4-kserve-route","namespace":"ai-tenant-e2e-shared-b-314eb4","uid":"0ac71bb9-c3d1-4961-89ed-1eb95460c7a5","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-314eb4-kserve-route\" not found"}
{"level":"error","ts":"2026-07-14T17:04:23.326Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-584665","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:04:23.630Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:26.627Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","WasmPlugin","TokenRateLimitPolicy","Limitador","HTTPRoute"],"eventTypes":{"delete":3,"update":7}}
{"level":"info","ts":"2026-07-14T17:04:26.639Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:26.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:27.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:27.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:27.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:27.426Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:27.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:27.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:04:27.628Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:27.631Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:27.934Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:29.155Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:29.429Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:31.836Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","ConfigMap","TokenRateLimitPolicy","Limitador","AuthPolicy","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":21,"update":5}}
{"level":"info","ts":"2026-07-14T17:04:31.927Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:31.932Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:32.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:32.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:32.532Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:32.532Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:32.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:32.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:04:32.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:32.731Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:32.731Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:33.797Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:34.031Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:35.241Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-14T17:04:35.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:35.331Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:04:35.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:04:35.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:35.733Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:35.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:35.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:35.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:04:35.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:04:35.931Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:04:36.655Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:04:36.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:02.443Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","AuthPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-14T17:05:03.032Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:03.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:05:03.331Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:03.334Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:03.334Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:03.437Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:03.535Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:04.304Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:04.732Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:04.834Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-07-14T17:05:05.235Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:05.235Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:05.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:05.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:05.531Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:05:05.535Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d24a018a03d203a84c0bceae432fc2577d7c041b0471b014c8857be3c3986ead","error":"authconfigs.authorino.kuadrant.io \"d24a018a03d203a84c0bceae432fc2577d7c041b0471b014c8857be3c3986ead\" not found"}
{"level":"info","ts":"2026-07-14T17:05:05.628Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:05:05.631Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-314eb4","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-314eb4\" not found"}
{"level":"error","ts":"2026-07-14T17:05:05.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d0fecafb5f3a1b923399052760206c7edd6304a856ea01e37e8f15aaf27c55d2","error":"authconfigs.authorino.kuadrant.io \"d0fecafb5f3a1b923399052760206c7edd6304a856ea01e37e8f15aaf27c55d2\" not found"}
{"level":"error","ts":"2026-07-14T17:05:05.631Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-314eb4","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-314eb4\" not found"}
{"level":"error","ts":"2026-07-14T17:05:05.634Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:05:05.634Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:05:05.739Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-314eb4","wasmplugin":"openshift-ingress/kuadrant-e2e-shared-b-314eb4","error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-314eb4\" not found"}
{"level":"error","ts":"2026-07-14T17:05:05.936Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-314eb4","namespace":"openshift-ingress","uid":"138e64d1-bd1a-4be3-8a9d-1b594448a119","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:06.137Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"215cabbb-4b1e-4179-85f8-bf15d1db6957","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:06.226Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-314eb4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-314eb4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:06.226Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-584665","namespace":"openshift-ingress","uid":"e944aa63-0f3d-4504-8ad1-c9cffd7a68a6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-584665\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:06.334Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"4cac9cca-f635-46f8-92ea-6952c615af5e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:05:06.370Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:06.443Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:09.544Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap","EnvoyFilter","AuthConfig","WasmPlugin"],"eventTypes":{"delete":5,"update":7}}
{"level":"info","ts":"2026-07-14T17:05:09.626Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:09.631Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:05:09.733Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:05:09.733Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:10.131Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:10.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:10.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:10.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:10.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:05:10.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:10.431Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:11.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:11.340Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:11.442Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy"],"eventTypes":{"delete":2}}
{"level":"info","ts":"2026-07-14T17:05:12.029Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:12.034Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:12.126Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:12.126Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:12.227Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:05:12.227Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:12.328Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:05:12.731Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-314eb4","namespace":"openshift-ingress","uid":"138e64d1-bd1a-4be3-8a9d-1b594448a119","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-314eb4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:12.836Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"215cabbb-4b1e-4179-85f8-bf15d1db6957","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:05:12.933Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"4cac9cca-f635-46f8-92ea-6952c615af5e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:05:12.933Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:13.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:14.429Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-14T17:05:14.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:14.447Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:05:14.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:05:14.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:14.928Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:14.928Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:14.938Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:15.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:05:15.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:05:15.031Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:05:15.606Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:05:15.733Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}