{"level":"error","ts":"2026-10-30T18:44:41.886Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T17:58:33Z","generation":60,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8d2b63d3-a73d-4157-a93c-4daa7ec5df64\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T18:01:05Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"8d2b63d3-a73d-4157-a93c-4daa7ec5df64"}],"resourceVersion":"18851","uid":"48381782-9b68-4155-a392-4ea70ddb47b3"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"} {"level":"info","ts":"2026-10-30T18:44:41.962Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-10-30T18:44:41.962Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"error","ts":"2026-10-30T18:44:42.032Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"max retry attempts reached, giving up","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","attempts":5,"duration":14.290100422,"error":"etcdserver: request is too large"} {"level":"info","ts":"2026-10-30T18:44:42.032Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"all non-blocking errors have exceeded max retry attempts","errorCount":0} {"level":"info","ts":"2026-10-30T18:44:45.845Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"delete":4,"update":4}} {"level":"info","ts":"2026-10-30T18:44:46.188Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-10-30T18:44:46.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-10-30T18:44:46.190Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-10-30T18:44:46.190Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:46.191Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-10-30T18:44:46.191Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:46.197Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-10-30T18:44:46.867Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T17:58:33Z","generation":60,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8d2b63d3-a73d-4157-a93c-4daa7ec5df64\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T18:01:05Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"8d2b63d3-a73d-4157-a93c-4daa7ec5df64"}],"resourceVersion":"18851","uid":"48381782-9b68-4155-a392-4ea70ddb47b3"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"} {"level":"info","ts":"2026-10-30T18:44:46.940Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-10-30T18:44:46.940Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:47.007Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"} {"level":"info","ts":"2026-10-30T18:44:47.007Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2} {"level":"info","ts":"2026-10-30T18:44:49.008Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1} {"level":"info","ts":"2026-10-30T18:44:49.026Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"delete":4,"update":4}} {"level":"info","ts":"2026-10-30T18:44:49.375Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-10-30T18:44:49.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-10-30T18:44:49.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:49.385Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-10-30T18:44:49.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-10-30T18:44:49.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:49.387Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-10-30T18:44:50.042Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-10-30T17:58:33Z","generation":60,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8d2b63d3-a73d-4157-a93c-4daa7ec5df64\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-10-30T18:01:05Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"8d2b63d3-a73d-4157-a93c-4daa7ec5df64"}],"resourceVersion":"18851","uid":"48381782-9b68-4155-a392-4ea70ddb47b3"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/echo-simulator-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n attributes: envoy.service.auth.v3.AttributeContext {\\n request: envoy.service.auth.v3.AttributeContext.Request {\\n time: request.time,\\n http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n host: request.host,\\n method: request.method,\\n scheme: request.scheme,\\n path: request.path,\\n protocol: request.protocol,\\n headers: request.headers\\n }\\n },\\n destination: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: destination.address,\\n port_value: uint(destination.port)\\n }\\n }\\n },\\n source: envoy.service.auth.v3.AttributeContext.Peer {\\n address: envoy.config.core.v3.Address {\\n socket_address: envoy.config.core.v3.SocketAddress {\\n address: source.address,\\n port_value: uint(source.port)\\n }\\n }\\n },\\n context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n amount: uint(0),\\n ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"} {"level":"info","ts":"2026-10-30T18:44:50.112Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-10-30T18:44:50.112Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-10-30T18:44:50.181Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":4}