{"level":"info","ts":"2026-07-17T06:39:43.831Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-17T06:39:44.344Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-ff4257","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:03Z","generation":10,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3178e402-8b02-4187-afa2-2e74c8dc9c46\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:39:03Z"}],"name":"kuadrant-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}],"resourceVersion":"73090","uid":"472667e3-47cc-467f-9d41-277c582d9d29"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"89d21799761822a698badc4b72a90b998a9932fb338b0891954784bdb8b40062","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"13a0458c97150c9499d1a8c045e7e8e074e83f4a6f5ca5fe43b3cbb6a1a43cea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"a3940323459b81522f7c887ad9a2027268092f6d388e135662f4a9c166688fdf","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"dcb5a451be04106f1dda565abed7f09b2438f1417158f4af9fc4086577fcc1df","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:44.538Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-346c23","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:10Z","generation":15,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"47b1f1ba-d204-4f14-b4e1-684e8acba17f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:39:29Z"}],"name":"kuadrant-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}],"resourceVersion":"73501","uid":"dfd0faaf-d23b-44cf-8689-cf4c61582aa4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"d30e10718f05559e8907ca5f35d944a8721e48b226b423484c0aaa10968beb72","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"14df8b8c77b94524774e2015d6e981d3c9b0de4952618184b2f33d29aca36ce5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"83268060d280203823a0df822ba69ef532cfc3ac84ab78ad368208fb4f2f750e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"2012622433161d51d0497110ef5d6f647071cd1f33463e597823e1408ef33db2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:44.551Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-346c23","namespace":"openshift-ingress","uid":"6b18a5ca-9956-42b4-a619-4f3837488c1e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:44.638Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"6c5f2904-9359-4bb4-87e8-59e856c59d1c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:44.740Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-ff4257","namespace":"openshift-ingress","uid":"956ea939-7590-48b2-a7c3-6dcc22ab4b39","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:44.822Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"39bad2a1-a14b-4d85-aa9b-534de412c1f6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:45.022Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-ff4257","namespace":"ai-tenant-e2e-shared-a-ff4257","uid":"e7608305-c184-4178-970c-9ccb7917587e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-ff4257\" not found"}
{"level":"error","ts":"2026-07-17T06:39:45.131Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-346c23","namespace":"ai-tenant-e2e-shared-b-346c23","uid":"14362fd2-ee40-4a24-ac95-bdbd70055018","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:45.229Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:45.232Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-ff4257-kserve-route","namespace":"ai-tenant-e2e-shared-a-ff4257","uid":"e40f3d18-3396-4497-8279-9decb141dc22","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-ff4257-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:45.243Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-346c23","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:45.245Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-346c23-kserve-route","namespace":"ai-tenant-e2e-shared-b-346c23","uid":"f77ab773-0f97-462b-a915-efeab3bd3bbe","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-346c23-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:39:48.422Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthConfig","HTTPRoute","TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","WasmPlugin","AuthPolicy"],"eventTypes":{"create":26,"delete":3,"update":15}}
{"level":"info","ts":"2026-07-17T06:39:48.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:48.531Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:39:49.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:39:49.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:39:49.533Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:49.533Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:39:49.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:50.027Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:39:50.032Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:39:50.324Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-17T06:39:50.422Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:39:50.422Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:39:52.635Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:52.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:39:53.332Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":4,"delete":1}}
{"level":"info","ts":"2026-07-17T06:39:54.522Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:54.522Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:39:54.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:55.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:39:55.130Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-17T06:39:55.130Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:39:55.130Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-17T06:39:55.646Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-ff4257","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:03Z","generation":11,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3178e402-8b02-4187-afa2-2e74c8dc9c46\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:39:40Z"}],"name":"kuadrant-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}],"resourceVersion":"73809","uid":"472667e3-47cc-467f-9d41-277c582d9d29"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"99b2cc860e2f433f03bc1fd44b8e88ea76edaca4ff3bddc87200cdca1fdfaf84","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"7eac94ced9aa3dfc9866c89dfc3f09ff2833c29d4ad42da9bcd70cf02dd114c6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"99b2cc860e2f433f03bc1fd44b8e88ea76edaca4ff3bddc87200cdca1fdfaf84","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"3005ac8d81df4a91c0afc9d3e7e788b47505d5030bbfcb2e35c5afdb063e6aa3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"706a00fbe26b4996545004adcfed0fc4104c6e18eff25b839d39be8a155c15c7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"d35de6728327aec4ee1277024204c2f799b4ed00f4722954557d2403769be04d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"706a00fbe26b4996545004adcfed0fc4104c6e18eff25b839d39be8a155c15c7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"0fc2b53a4a0483d45a7b794b4409aa09df2e8f7e58659ff178496d97d1588567","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"201d11960d6c86c5440b22aa8066de071db47eb129543f97c92a9e9eb5d2dcaa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"579c22fa9085c5598c59a26ce2fad869046c6004d8c06aff6e154f99f92e0aa4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"201d11960d6c86c5440b22aa8066de071db47eb129543f97c92a9e9eb5d2dcaa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"8eb6f26c2c566973148055790f3296c312e41f3a2e90201d270c31ff024aebab","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ee185b24494917be8d5f789d4f7c9b0a314ec302bfdf63c37f4a21a2b27c9a9c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"0255d9283663112e274c04a12845cdbcbd1a94fc0af4ad121a96089a95e0d8cb","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"fc04645de63dadf067fc14c6d44de4322fdb243cc169ea6a36f7c5d948e1e772","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"9f09b08dad3085ddb449479be6aa68cd7f2a9e2baf66e0a48fd33463c4e4f9e4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9f20a4bc682f2c77c4ee1d5ecd38b55b9f2855939a5648d062af40ffb76c2903","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"e64f6fca6616f9e44a62cf076031cb970ceb17fb30a2ca34fa825690db4d45f4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"dabc84457947e0ee14198d28c480d8a4f50f0087dcfe999d21ee6e603068889d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"2b34ddfb3e2569e3b86a1c6ae819daba2009869995e2568784feae10b5420153","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"89d21799761822a698badc4b72a90b998a9932fb338b0891954784bdb8b40062","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"13a0458c97150c9499d1a8c045e7e8e074e83f4a6f5ca5fe43b3cbb6a1a43cea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"a3940323459b81522f7c887ad9a2027268092f6d388e135662f4a9c166688fdf","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"dcb5a451be04106f1dda565abed7f09b2438f1417158f4af9fc4086577fcc1df","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"dade9453e9fc2ed4012621eeeba491a1b51aa50493f2a867bc20d46d0ecc9c6f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_a_only_c7469f_sub_test_model_ff4257_tokens__2a71de98","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-a-only-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_shared_sub_c7469f_sub_test_model_ff4257_tokens__51fd7c03","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/sub-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-sub-test-model-ff4257"]}],"name":"f168c2d79c77a4e3a574867f5f3b15ef23a0984b790759845cf0b2015064d946","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:55.842Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-346c23","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:10Z","generation":16,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"47b1f1ba-d204-4f14-b4e1-684e8acba17f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:39:40Z"}],"name":"kuadrant-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}],"resourceVersion":"73778","uid":"dfd0faaf-d23b-44cf-8689-cf4c61582aa4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"006778ec320449f8c890ced6b8a8e5e0f51a79b70af2ea9ef7ae23daadaf3483","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"78a4332e531fe3fb8c40f23e4d7a1f5d5a8d9674927668042f6e3128fdeb5e3b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"006778ec320449f8c890ced6b8a8e5e0f51a79b70af2ea9ef7ae23daadaf3483","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"c00d21017158658b1c977e4a0c0d4ec3eb79112cbd1dd1b8b75b55a6021f93da","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f8329ffec51e9fb34362134757d3eb6ac892c2a0e98789ed45d584476168a3b2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"4964fa11c40ea8c947fac52a6716d61a0a7eee56bf16dab7d435b8811be7c19a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f8329ffec51e9fb34362134757d3eb6ac892c2a0e98789ed45d584476168a3b2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"572f9a516c2d6b9159a1e9e73e65a9d88fcd3b8f42c0f0d0fe8f19334c26c9fc","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a91c66ad3d557bb37ef14a4375df54959e2a32cf8ece469e25806c4e7b92152f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"f56899e1687e289fb53c37d3df259eaec0538f998a92cf05ec7f18377e1e6b74","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a91c66ad3d557bb37ef14a4375df54959e2a32cf8ece469e25806c4e7b92152f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"6214cb8fdb8a4b1e5ea053ed55dded61c7f79b5447025df83c308da178b3779a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e97fad28427f3db3afbe7ad5f617e209eccb1b7ec25d60ceb73060456a12fee9","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"4add370bd2d026916519385d8e4465993330e012baa1cfd773a141c446c09677","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6f6faa4ab3d1cbee0f6dabf2aad4726d31324435c6ee1f14fcb447317353eab9","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"0108ffa2b731cf9eb3d371fee452cd680249759676ed1aaa0bd9a0d57b30aa32","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a2ca560f037a8643762fc33a17dbe40606b09b0f8efbf1ff29d65882275fc3fc","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"6f8a9280be104f5299456626c69ce5149b4566986b25b651d353a1db14a5b4f3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"34e2562707884c9c6990567f3c8eaaa487c1004449a4618edc66e56c08e9a80e","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"4339b2bc9df97595382a9c0f51105067df43df4f46f112b9b4490bb59af92354","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"d30e10718f05559e8907ca5f35d944a8721e48b226b423484c0aaa10968beb72","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"14df8b8c77b94524774e2015d6e981d3c9b0de4952618184b2f33d29aca36ce5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"83268060d280203823a0df822ba69ef532cfc3ac84ab78ad368208fb4f2f750e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"2012622433161d51d0497110ef5d6f647071cd1f33463e597823e1408ef33db2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"950ed38f3e1d312dfbc9b670e636e22d0bd2753eabdd73a045b3208679785ce5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_shared_sub_c7469f_sub_test_model_346c23_tokens__266896da","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-shared-sub-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_b_only_c7469f_sub_test_model_346c23_tokens__21152648","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-b-only-c7469f@ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/sub-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-sub-test-model-346c23"]}],"name":"d6eaeeaa6341b5682896a543ac63c3c3b4594f16185489cd27900ed01e009a52","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:56.726Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-346c23-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-346c23-maas-auth\" not found"}
{"level":"error","ts":"2026-07-17T06:39:56.932Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-346c23","namespace":"ai-tenant-e2e-shared-b-346c23","uid":"0c75360c-7202-49f7-a07c-37e413324ee9","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-346c23\" not found"}
{"level":"error","ts":"2026-07-17T06:39:57.129Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-ff4257-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-ff4257-maas-auth\" not found"}
{"level":"error","ts":"2026-07-17T06:39:57.130Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-ff4257","namespace":"ai-tenant-e2e-shared-a-ff4257","uid":"ecd0d0b5-4826-4796-8834-65318fd01df6","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-ff4257\" not found"}
{"level":"error","ts":"2026-07-17T06:39:57.253Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:39:57.329Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-346c23","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:39:59.041Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","WasmPlugin","Gateway","TokenRateLimitPolicy","AuthPolicy","HTTPRoute"],"eventTypes":{"delete":6,"update":6}}
{"level":"info","ts":"2026-07-17T06:39:59.135Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:39:59.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:39:59.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:39:59.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:00.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:00.322Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:00.322Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:00.522Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:00.731Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:00.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:40:00.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:02.140Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:02.536Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:04.735Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Limitador","TokenRateLimitPolicy","ConfigMap","WasmPlugin","HTTPRoute","EnvoyFilter","AuthConfig"],"eventTypes":{"delete":26,"update":10}}
{"level":"info","ts":"2026-07-17T06:40:04.937Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:05.125Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:05.322Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:05.322Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:05.722Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:05.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:05.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:05.829Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:06.022Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:06.022Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:06.124Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:07.044Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:07.322Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:08.534Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-17T06:40:08.545Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:08.628Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:08.822Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:08.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:09.529Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:09.530Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:09.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:09.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:09.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:09.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:10.439Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-17T06:40:10.926Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:40:10.927Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:13.129Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-17T06:40:14.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:14.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:14.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:14.526Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:14.628Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:40:14.826Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:14.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:15.549Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:16.034Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:18.236Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","WasmPlugin","Limitador","HTTPRoute"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-17T06:40:18.248Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:18.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:19.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:19.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:19.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:19.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:19.623Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:19.722Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:19.833Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:19.931Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:19.931Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:20.939Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:21.231Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:22.538Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-17T06:40:22.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:22.627Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:22.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:22.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:23.324Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:23.331Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:23.331Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:23.331Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:23.331Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:23.429Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:24.345Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:24.829Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:40.030Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-17T06:40:41.122Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:41.122Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:41.122Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:41.423Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:41.424Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:40:41.426Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:41.434Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:42.532Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:42.738Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:45.334Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","ConfigMap","WasmPlugin","Limitador"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-17T06:40:45.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:45.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:45.622Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:45.622Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:46.222Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:46.222Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:46.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:46.428Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:46.627Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:46.724Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:46.724Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:47.835Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:48.225Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:49.435Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-17T06:40:49.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:49.528Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:40:49.822Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:40:49.822Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:50.323Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:50.323Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:50.422Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:50.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:40:50.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:50.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:40:51.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:51.842Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:57.337Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-07-17T06:40:58.433Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:40:58.433Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:40:58.726Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:01.031Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":3}}
{"level":"info","ts":"2026-07-17T06:41:01.930Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:01.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:01.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:02.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"error","ts":"2026-07-17T06:41:02.422Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04\" already exists"}
{"level":"info","ts":"2026-07-17T06:41:02.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-17T06:41:02.624Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-346c23","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-346c23\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.635Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-ff4257","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-ff4257\" already exists"}
{"level":"info","ts":"2026-07-17T06:41:02.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-17T06:41:02.723Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.736Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.822Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.845Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-ff4257","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:03Z","generation":14,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3178e402-8b02-4187-afa2-2e74c8dc9c46\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:40:15Z"}],"name":"kuadrant-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}],"resourceVersion":"74535","uid":"472667e3-47cc-467f-9d41-277c582d9d29"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"8aec53feb0a2042496a611c874e3ed3852d05e1f985618e4377e55b295671d30","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"4091d1d36216eb3fec11f11f6b520aa9308a5aa7c2a27efcb2740bb3750b3171","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"287274b93c4846b2e6166ae6286afc23c775e879a67dc2fa0781d3d626c6d09a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"b253d53c5805e3cd531975dbd5587486dbac1b780d65a3d98f13862c7197738f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"f8c12242ccac4eb986ca6aa4e0efbc10a22962c77dda0514101a9a9bbc0e5921","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"697486c160cc669ee7fb2d4e58fd7aa3b83038a6b08206344f4a89e800bb9890","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"08ab09c787e24eed4a7e08ee2ddcc4287bc7230577f2a804b5b1b2369b5dcc3b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"d0a74c6a40756ed0f5f4e058f6aa665b14ceb74d4a509d8c90d334ea2c5ba3e3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"65fc7bc57c517c668633ee00ceccabda65510baca577b11ed9c79e8d50df9396","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"06aefef2280d9506f4750769e93ee077dd8f13e0ea65b1f3c1ed33a831e1223c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"89d21799761822a698badc4b72a90b998a9932fb338b0891954784bdb8b40062","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"13a0458c97150c9499d1a8c045e7e8e074e83f4a6f5ca5fe43b3cbb6a1a43cea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"a3940323459b81522f7c887ad9a2027268092f6d388e135662f4a9c166688fdf","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"dcb5a451be04106f1dda565abed7f09b2438f1417158f4af9fc4086577fcc1df","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_43cd4c_rate_test_model_ff4257_tokens__8c693428","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-43cd4c@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"bc347779c4e370b15fd2978ab4b50cb835a0cfccf696dea866769e4e0f4f72d1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:02.851Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.934Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:02.936Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-346c23","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:10Z","generation":19,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"47b1f1ba-d204-4f14-b4e1-684e8acba17f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:40:41Z"}],"name":"kuadrant-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}],"resourceVersion":"75014","uid":"dfd0faaf-d23b-44cf-8689-cf4c61582aa4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"1e1fd885a1cd24c9ffb6593d635f1f56ea4a79ba2b9691ba9313a2ee3650df92","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"fb30625582bf117b40c2630c8ee318f88e3c3f9792454cf22d2b11448b26b9f2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"cdac288eb948af706d0ae7dd7e87558b78366a15b38fa98365a53fe6b63f279e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"9736bccac901d6478db948a5dcce1cc8379820a034f0b8c4af59b3733eca9f3b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"c87c8117f2b64c54fe67ead2ea990d2821be4612f5e8816f28c75145a495f155","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"f3ec93b6e7a15cb6545084c51740e542a9cbe3b9ee05880ff3d2a743240502f0","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"c148ac1c7230cc8c07ef2f4332c66f96a3de244e8ebe83f6b1d8c6e929a87737","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"0057695592911d24878f653f477642846fd041f2bebf79795063cc22d5c3b419","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"b1d045ee23fc0863e3c5c932e7707e5478cc58f15de7773cf695f7bac7f40b56","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"1200729f82974aa25f2e8810db379205d7c9a13f83907b84668a41987e9d85e1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"d30e10718f05559e8907ca5f35d944a8721e48b226b423484c0aaa10968beb72","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"14df8b8c77b94524774e2015d6e981d3c9b0de4952618184b2f33d29aca36ce5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"83268060d280203823a0df822ba69ef532cfc3ac84ab78ad368208fb4f2f750e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"2012622433161d51d0497110ef5d6f647071cd1f33463e597823e1408ef33db2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_43cd4c_rate_test_model_346c23_tokens__eb95f30b","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-43cd4c@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"05507c9c70d8aeacad3771583f7ef89eff34c60f61efdcde583ab0186662c371","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:02.946Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.052Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.065Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.079Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.093Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.138Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.166Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.211Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.242Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-346c23.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.273Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","httpRouteRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-ff4257.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d\" already exists"}
{"level":"error","ts":"2026-07-17T06:41:03.534Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-ff4257-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-ff4257-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:03.922Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-346c23-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-346c23-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.060Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.122Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-346c23","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.129Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-ff4257","namespace":"odh-ai-gateway-infra","uid":"3b9f614d-46a8-4b13-a4e2-ed2acd513f88","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.138Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-346c23-kserve-route","namespace":"ai-tenant-e2e-shared-b-346c23","uid":"3a2091b0-2cc2-4310-b29b-118c1dab06e9","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-346c23-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.149Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-ff4257-kserve-route","namespace":"ai-tenant-e2e-shared-a-ff4257","uid":"41936ea1-7ff3-4247-b0fe-57dfa5e974fe","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-ff4257-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:04.158Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-346c23","namespace":"odh-ai-gateway-infra","uid":"7b7bb361-1074-410e-917e-2181a9a769d5","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:07.134Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","WasmPlugin","EnvoyFilter","AuthPolicy","HTTPRoute","TokenRateLimitPolicy","ConfigMap","Gateway","Limitador"],"eventTypes":{"create":26,"update":18}}
{"level":"info","ts":"2026-07-17T06:41:07.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:08.024Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:08.131Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:08.131Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:08.522Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:08.629Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:08.733Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:41:08.733Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:08.831Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:08.831Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:08.831Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:11.631Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:12.138Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:16.734Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","WasmPlugin","ConfigMap","HTTPRoute"],"eventTypes":{"update":12}}
{"level":"info","ts":"2026-07-17T06:41:16.748Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:16.829Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:17.122Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:17.122Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:17.922Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:17.922Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:18.022Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:18.125Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:18.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:41:18.729Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:18.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:20.923Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:21.623Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:21.732Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"create":4,"delete":4}}
{"level":"info","ts":"2026-07-17T06:41:22.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:22.822Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:22.822Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:22.829Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:23.228Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-17T06:41:23.329Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:23.329Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-17T06:41:23.835Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-346c23","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:10Z","generation":21,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"47b1f1ba-d204-4f14-b4e1-684e8acba17f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:41:09Z"}],"name":"kuadrant-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}],"resourceVersion":"75501","uid":"dfd0faaf-d23b-44cf-8689-cf4c61582aa4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"1e1fd885a1cd24c9ffb6593d635f1f56ea4a79ba2b9691ba9313a2ee3650df92","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"fb30625582bf117b40c2630c8ee318f88e3c3f9792454cf22d2b11448b26b9f2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"cdac288eb948af706d0ae7dd7e87558b78366a15b38fa98365a53fe6b63f279e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"9736bccac901d6478db948a5dcce1cc8379820a034f0b8c4af59b3733eca9f3b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"c87c8117f2b64c54fe67ead2ea990d2821be4612f5e8816f28c75145a495f155","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"f3ec93b6e7a15cb6545084c51740e542a9cbe3b9ee05880ff3d2a743240502f0","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"c148ac1c7230cc8c07ef2f4332c66f96a3de244e8ebe83f6b1d8c6e929a87737","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"0057695592911d24878f653f477642846fd041f2bebf79795063cc22d5c3b419","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"b1d045ee23fc0863e3c5c932e7707e5478cc58f15de7773cf695f7bac7f40b56","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"1200729f82974aa25f2e8810db379205d7c9a13f83907b84668a41987e9d85e1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"d30e10718f05559e8907ca5f35d944a8721e48b226b423484c0aaa10968beb72","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"14df8b8c77b94524774e2015d6e981d3c9b0de4952618184b2f33d29aca36ce5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"83268060d280203823a0df822ba69ef532cfc3ac84ab78ad368208fb4f2f750e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"2012622433161d51d0497110ef5d6f647071cd1f33463e597823e1408ef33db2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-346c23-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_346c23_e2e_rate_iso_b_1fb515_rate_test_model_346c23_tokens__ee7896de","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-346c23/e2e-rate-iso-b-1fb515@ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-346c23/rate-test-model-346c23-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-346c23/maas-trlp-rate-test-model-346c23"]}],"name":"05507c9c70d8aeacad3771583f7ef89eff34c60f61efdcde583ab0186662c371","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-346c23/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:23.852Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-ff4257","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:03Z","generation":16,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3178e402-8b02-4187-afa2-2e74c8dc9c46\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:41:09Z"}],"name":"kuadrant-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}],"resourceVersion":"75499","uid":"472667e3-47cc-467f-9d41-277c582d9d29"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"8aec53feb0a2042496a611c874e3ed3852d05e1f985618e4377e55b295671d30","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"4091d1d36216eb3fec11f11f6b520aa9308a5aa7c2a27efcb2740bb3750b3171","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"287274b93c4846b2e6166ae6286afc23c775e879a67dc2fa0781d3d626c6d09a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"b253d53c5805e3cd531975dbd5587486dbac1b780d65a3d98f13862c7197738f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"f8c12242ccac4eb986ca6aa4e0efbc10a22962c77dda0514101a9a9bbc0e5921","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"697486c160cc669ee7fb2d4e58fd7aa3b83038a6b08206344f4a89e800bb9890","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"08ab09c787e24eed4a7e08ee2ddcc4287bc7230577f2a804b5b1b2369b5dcc3b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"d0a74c6a40756ed0f5f4e058f6aa665b14ceb74d4a509d8c90d334ea2c5ba3e3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"65fc7bc57c517c668633ee00ceccabda65510baca577b11ed9c79e8d50df9396","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"06aefef2280d9506f4750769e93ee077dd8f13e0ea65b1f3c1ed33a831e1223c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"89d21799761822a698badc4b72a90b998a9932fb338b0891954784bdb8b40062","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"13a0458c97150c9499d1a8c045e7e8e074e83f4a6f5ca5fe43b3cbb6a1a43cea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"a3940323459b81522f7c887ad9a2027268092f6d388e135662f4a9c166688fdf","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"dcb5a451be04106f1dda565abed7f09b2438f1417158f4af9fc4086577fcc1df","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-ff4257-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_ff4257_e2e_rate_iso_a_1fb515_rate_test_model_ff4257_tokens__d58e6dd4","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-ff4257/e2e-rate-iso-a-1fb515@ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-ff4257/rate-test-model-ff4257-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-ff4257/maas-trlp-rate-test-model-ff4257"]}],"name":"bc347779c4e370b15fd2978ab4b50cb835a0cfccf696dea866769e4e0f4f72d1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-ff4257/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:23.932Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-ff4257","namespace":"ai-tenant-e2e-shared-a-ff4257","uid":"6cee1f10-2024-496b-a9eb-04a0ce5f644e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:24.230Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"39bad2a1-a14b-4d85-aa9b-534de412c1f6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:24.634Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-346c23-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-346c23-maas-auth\" not found"}
{"level":"error","ts":"2026-07-17T06:41:24.723Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"6c5f2904-9359-4bb4-87e8-59e856c59d1c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:24.930Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-ff4257-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-ff4257-maas-auth\" not found"}
{"level":"error","ts":"2026-07-17T06:41:25.029Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-346c23","namespace":"ai-tenant-e2e-shared-b-346c23","uid":"2fdfac1d-a187-48c7-92f6-d40c1a4e611c","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-346c23\" not found"}
{"level":"info","ts":"2026-07-17T06:41:28.429Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","WasmPlugin","ConfigMap","AuthPolicy","HTTPRoute"],"eventTypes":{"delete":6,"update":6}}
{"level":"info","ts":"2026-07-17T06:41:28.457Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:28.628Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:28.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:28.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:28.925Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:29.222Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:29.222Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:29.233Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:29.433Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:29.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-17T06:41:29.633Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:29.633Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:30.954Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:31.330Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:31.629Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-07-17T06:41:32.631Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:32.631Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:32.722Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:33.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-17T06:41:33.024Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36","error":"authconfigs.authorino.kuadrant.io \"8b9d2d2f02ba3496cc642c0acc541e126096e77cda03880d218e5bcdeccdec36\" not found"}
{"level":"info","ts":"2026-07-17T06:41:33.027Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-17T06:41:33.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2","error":"authconfigs.authorino.kuadrant.io \"ceaf545a22b82b43a8b5c9d346ae7fb840433dcb5ba9f840a7ede0b9104fbed2\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.029Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-a-ff4257","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-ff4257\" not found"}
{"level":"info","ts":"2026-07-17T06:41:33.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-17T06:41:33.222Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-346c23","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-346c23\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.222Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04","error":"authconfigs.authorino.kuadrant.io \"44f0b99c0b7b9123fe47053180eddbb720e03e6b02e66293f46122e469ca7c04\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.222Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:33.222Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-17T06:41:33.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a","error":"authconfigs.authorino.kuadrant.io \"8443be066d716aefe1b28abbc85c229023e8aed970aad6f867f5add3c2ad7c8a\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.229Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593","error":"authconfigs.authorino.kuadrant.io \"8ac42768bf1454a3e683b718611b43f292b6642219da0b94c5cdfe280bd1f593\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.232Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b","error":"authconfigs.authorino.kuadrant.io \"1572509122d0efd4a4662c6f1b9b74000c28a9c8842d8beb65a3c599f52fb32b\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0","error":"authconfigs.authorino.kuadrant.io \"5c2ff3fbd8924097f30fd090257c19073244079ecf6b615b52bf9faba4df0bb0\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.322Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c","error":"authconfigs.authorino.kuadrant.io \"2de599c44ec59fbbf8e9f1ba82a7689e665cfd1af8dc7566c436ada9303e231c\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.327Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5","error":"authconfigs.authorino.kuadrant.io \"f161e5b7f3d256bf983a04328ec2c4b83e81b2d98ac49b70fd714131509a2cb5\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d","error":"authconfigs.authorino.kuadrant.io \"8e01a4c6fe36ce4ce452e1d94f324f4b52bed22c3dabeb5cf86e85afc969de1d\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7","error":"authconfigs.authorino.kuadrant.io \"9abad7381e6390d32d72ef90d4248166c5827991b9ef2ab8ab8e87dff34ab4a7\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.428Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c","error":"authconfigs.authorino.kuadrant.io \"a21c322eb2ac614d6d28492d35ca822ba0f2b6f2fc694577ac11d1344865c21c\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.431Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67","error":"authconfigs.authorino.kuadrant.io \"613c4c24edc76d1b1f3b204c51aafe6ad77ed69ca137fea3161aa43f4b465d67\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.522Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427","error":"authconfigs.authorino.kuadrant.io \"1f0eeb2eb10c6255f3ba01a552c87137c59ea3df80b41e571f205765a600c427\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.526Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f","error":"authconfigs.authorino.kuadrant.io \"4e83edd2412896b5bdf30b0b25e28f2738f3324558a2ff5649ce9048f987a46f\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce","error":"authconfigs.authorino.kuadrant.io \"a6c2226b0bdab5e380dd0a00a5b1703dca543c696996bb4532d61a0a99010fce\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.532Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78","error":"authconfigs.authorino.kuadrant.io \"4f87844cbbf799f4398a1d581bca365a1e0869ec1e19077adf02a9f5a23a4a78\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b","error":"authconfigs.authorino.kuadrant.io \"2ef4da9b9962b7f72ff7b766155a53a8b33ba20019ea4b24102b514241561e9b\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.537Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-ff4257","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:03Z","generation":17,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3178e402-8b02-4187-afa2-2e74c8dc9c46\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:41:19Z"}],"name":"kuadrant-e2e-shared-a-ff4257","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-ff4257","uid":"3178e402-8b02-4187-afa2-2e74c8dc9c46"}],"resourceVersion":"75722","uid":"472667e3-47cc-467f-9d41-277c582d9d29"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"89d21799761822a698badc4b72a90b998a9932fb338b0891954784bdb8b40062","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"13a0458c97150c9499d1a8c045e7e8e074e83f4a6f5ca5fe43b3cbb6a1a43cea","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"a3940323459b81522f7c887ad9a2027268092f6d388e135662f4a9c166688fdf","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__29fb818d","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-ff4257","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-ff4257"]}],"name":"dcb5a451be04106f1dda565abed7f09b2438f1417158f4af9fc4086577fcc1df","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-ff4257"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:33.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee","error":"authconfigs.authorino.kuadrant.io \"d60faa616f1b08248f3c8939bb59f6a165bbef8292e6ad3baddf0eb70e0678ee\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.539Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4","error":"authconfigs.authorino.kuadrant.io \"201901854e06ff8c5947c1a9b2b25f07ec1c4ac14ccade6f6cddaefe57f082e4\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.543Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13","error":"authconfigs.authorino.kuadrant.io \"7d57757c8f48d638544854b850743d8b6f69306b0bfcd07324a3711d89d8cd13\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.546Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155","error":"authconfigs.authorino.kuadrant.io \"e4710184e5347b680f68276fcdf26159610c1c1cd96d81bcf4aac40099b29155\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.546Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-346c23","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-17T06:36:10Z","generation":22,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"47b1f1ba-d204-4f14-b4e1-684e8acba17f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-17T06:41:19Z"}],"name":"kuadrant-e2e-shared-b-346c23","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-346c23","uid":"47b1f1ba-d204-4f14-b4e1-684e8acba17f"}],"resourceVersion":"75728","uid":"dfd0faaf-d23b-44cf-8689-cf4c61582aa4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"d30e10718f05559e8907ca5f35d944a8721e48b226b423484c0aaa10968beb72","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/subscriptions')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"14df8b8c77b94524774e2015d6e981d3c9b0de4952618184b2f33d29aca36ce5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/api-keys')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"83268060d280203823a0df822ba69ef532cfc3ac84ab78ad368208fb4f2f750e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__b1182c21","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\") && !request.path.startsWith(\"/v1/subscriptions\") && !request.path.startsWith(\"/v1/api-keys\")"]}],"scope":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-346c23","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-346c23"]}],"name":"2012622433161d51d0497110ef5d6f647071cd1f33463e597823e1408ef33db2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-346c23"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:33.548Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14","error":"authconfigs.authorino.kuadrant.io \"09b8381b469e39f3e6422d89ff022e670bc6e1b2e840a83a4566cbb9a48dbd14\" not found"}
{"level":"error","ts":"2026-07-17T06:41:33.551Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee","error":"authconfigs.authorino.kuadrant.io \"9d9fe4447fafab8999c4a073f3d964f719431ead5a7348db9421eb162a68cfee\" not found"}
{"level":"error","ts":"2026-07-17T06:41:34.022Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-ff4257","namespace":"openshift-ingress","uid":"956ea939-7590-48b2-a7c3-6dcc22ab4b39","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:34.129Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-346c23","namespace":"openshift-ingress","uid":"6b18a5ca-9956-42b4-a619-4f3837488c1e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:34.235Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-17T06:41:34.331Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-346c23","namespace":"odh-ai-gateway-infra","uid":"7b7bb361-1074-410e-917e-2181a9a769d5","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:34.427Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:34.431Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-ff4257","namespace":"odh-ai-gateway-infra","uid":"3b9f614d-46a8-4b13-a4e2-ed2acd513f88","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-ff4257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-17T06:41:34.531Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-346c23","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-346c23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-17T06:41:34.534Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:36.833Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","WasmPlugin","TokenRateLimitPolicy","ConfigMap","Limitador","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":26,"update":10}}
{"level":"info","ts":"2026-07-17T06:41:36.931Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:36.937Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:37.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:37.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:37.628Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:37.628Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:37.722Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:37.729Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:41:37.734Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:37.926Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:37.931Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:38.734Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:39.131Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:41.424Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-07-17T06:41:41.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:41.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:41.622Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:41.622Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:41.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:42.033Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:41:42.034Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:42.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:42.543Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:42.729Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:43.932Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-17T06:41:43.946Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:44.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:41:44.234Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:41:44.234Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:44.529Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:44.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:44.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:44.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:41:44.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:44.726Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:45.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:45.932Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:58.229Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-17T06:41:59.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:59.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:41:59.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:41:59.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:41:59.430Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:59.435Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:41:59.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:00.052Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:00.632Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:02.631Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","ConfigMap","Limitador","WasmPlugin","EnvoyFilter"],"eventTypes":{"delete":2,"update":6}}
{"level":"info","ts":"2026-07-17T06:42:02.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:02.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:42:03.123Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:42:03.123Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:03.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:03.327Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:03.428Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:03.428Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:03.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:03.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:03.627Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:04.457Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:04.636Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:05.841Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","TokenRateLimitPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-17T06:42:05.932Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:05.938Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:42:06.022Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:42:06.022Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:06.332Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:06.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:06.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:06.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:06.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:06.627Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:07.253Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-17T06:42:07.429Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-ff4257","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-ff4257\" not found"}
{"level":"info","ts":"2026-07-17T06:42:07.530Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:08.823Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-07-17T06:42:09.422Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:09.423Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:09.524Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:09.524Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:09.530Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:09.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:09.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:10.439Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:10.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:20.827Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-17T06:42:21.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:21.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:21.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:21.533Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:21.826Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:21.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-17T06:42:21.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:22.354Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:22.730Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:24.735Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Limitador","ConfigMap","EnvoyFilter","WasmPlugin"],"eventTypes":{"delete":2,"update":5}}
{"level":"info","ts":"2026-07-17T06:42:24.833Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:25.123Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:42:25.222Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:42:25.222Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:25.330Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:25.330Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:25.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:25.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:25.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:25.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:25.528Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:26.338Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:26.634Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:27.723Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-07-17T06:42:27.736Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:27.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-17T06:42:28.122Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-17T06:42:28.122Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:28.331Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:28.433Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:28.433Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:28.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:28.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:28.527Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:29.135Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:29.239Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:31.625Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-07-17T06:42:32.128Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:32.133Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:32.133Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:32.232Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-17T06:42:32.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:32.328Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-17T06:42:32.328Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-17T06:42:33.036Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-17T06:42:33.423Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}