apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  creationTimestamp: "2026-07-24T14:44:21Z"
  generation: 4
  labels:
    kuadrant.io/managed: "true"
  managedFields:
  - apiVersion: extensions.istio.io/v1alpha1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .: {}
          f:kuadrant.io/managed: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"3762b8e8-c0c8-469e-8cac-cf274ed3511e"}: {}
      f:spec:
        .: {}
        f:phase: {}
        f:pluginConfig:
          .: {}
          f:actionSets: {}
          f:services:
            .: {}
            f:auth-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-check-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-report-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
        f:targetRefs: {}
        f:url: {}
    manager: manager
    operation: Update
    time: "2026-07-24T14:44:57Z"
  name: kuadrant-maas-default-gateway
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Gateway
    name: maas-default-gateway
    uid: 3762b8e8-c0c8-469e-8cac-cf274ed3511e
  resourceVersion: "22036"
  uid: ea90e308-8d04-4e1d-8e2a-60d4b919b064
spec:
  phase: STATS
  pluginConfig:
    actionSets:
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 601d81fda832decfce1c5053e422906c83b94dd9aa69f4b03ab357b22e61bc24
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 6890f01a44426c8a6658b8ed6c146d281ba56ede4776b6711d5a9ed031129e90
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 3f50162934b8442aa1c7d3fe0566b1a268651b5cfb43ca14790d4f6ae94e75b9
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: cbd0c2da2572a35cd3b4337f215f7ea87eb0fd2dab2d8b96a3633b802e944cf3
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 85c982c88d9466ebd7ce94310e7978a85a1c8a6c0f7fcdf68c762b8a79a7860e
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: ebf262d81e9e0daaa8fcac40d52039da5da83fdbb029d58af91e31b7c45bfe72
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: a4672318dbe7de689ca987abd21f718491b5597266f1da5894f0e59c64eab549
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 97baef229ab3877742037427f279d74d823fdac1d905b3adf54884f62cd6642a
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: ad7d667caddb2207467d27d0779f1dbeb8f53b0ca39f480c1369b90b0a367604
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 36c8ba65006e5577c7a476d48d29ab91f0ec0b33de807766cee8c1336494e7ab
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 0105d4208d66ad741b8681e85b96793a715e24d0d0a0d2b3204ee65b7d288402
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: d591112877efdde642f281cf7a34df493f7ef1fa6dd33e44e5d2331f6ba6eace
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 83911473fcf646d3aeb0ebfe2232465df1d92f3dfe24d732efb482fe88d2150c
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: d0751135b15b5ff103c70e20d2f13f028c6451c15e5543d7a1975b13ee1f8149
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: d650c1afdfdf169b5610ad9111b60930f37156b615b0355f0d3daf7d6b652469
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b47ff88d8f715ce1c182878ed3f0b7215857e31c4ed7fa2045e4147acae6e7ed
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 37d38d688f4881b6b6d78cf081dd62e7a0613d1931344fe9f5b636dd5d771db1
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: d7c406f2d2ae2f6c90c20903b3305542161b69909af04b9cee227e6f10d23749
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 51a401bb4ddbb0fe2513a6e765bdfbf6464c5e758b10663ba38fde7f0d29bc5a
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 0b5a6187a78299fcac4b829a0f47b6126e6912ff54492f10d77d2c71123f38d6
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-simulated')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/subscriptions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/api-keys')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/models')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/maas-api')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b31b113eaf857adeea063c1c889264c6469db8010a1480fe954ee10226d78bc1
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/')
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: ba65b23589a72ce6e33415ed975e7f1e8e24535caedae240732daa133d631027
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/')
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model')
    services:
      auth-service:
        endpoint: kuadrant-auth-service
        failureMode: deny
        timeout: 200ms
        type: auth
      ratelimit-check-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: deny
        timeout: 100ms
        type: ratelimit-check
      ratelimit-report-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: deny
        timeout: 100ms
        type: ratelimit-report
      ratelimit-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: allow
        timeout: 100ms
        type: ratelimit
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: maas-default-gateway
  url: quay.io/kuadrant/wasm-shim:v0.12.1