apiVersion: v1
items:
- apiVersion: kuadrant.io/v1
  kind: AuthPolicy
  metadata:
    creationTimestamp: "2026-11-03T20:08:11Z"
    generation: 36
    labels:
      app.kubernetes.io/component: gateway-auth
      app.kubernetes.io/managed-by: maas-controller
      app.kubernetes.io/part-of: maas-gateway-auth
    name: maas-gateway-auth
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: gateway.networking.k8s.io/v1
      controller: true
      kind: Gateway
      name: maas-default-gateway
      uid: bbda65d9-6bec-4f60-8456-81b85a104172
    resourceVersion: "234173"
    uid: 0f1a5727-873b-4123-a11e-ccf7cdff048a
  spec:
    defaults:
      rules:
        authentication:
          api-keys:
            metrics: false
            plain:
              selector: request.headers.authorization
            priority: 0
            when:
            - operator: matches
              selector: request.headers.authorization
              value: ^Bearer ****
          openshift-identities:
            kubernetesTokenReview:
              audiences:
              - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/815d9
            metrics: false
            priority: 2
        authorization:
          auth-valid:
            cache:
              key:
                selector: '"api-key|" + (request.headers.authorization.replace("Bearer
                  ", "")) + "|" + (size(request.path.split("/").filter(x, x != ""))
                  >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" &&
                  request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x,
                  x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: |-
                allow {
                  object.get(input.auth.metadata, "apiKeyValidation", {})
                  input.auth.metadata.apiKeyValidation.valid == true
                }
                allow {
                  not input.auth.metadata.apiKeyValidation
                }
            priority: 0
          deny-api-key-management:
            metrics: false
            patternMatching:
              patterns:
              - predicate: "false"
            priority: 0
            when:
            - predicate: (request.headers.authorization.matches("^Bearer ****"))
                && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/"))
          deny-client-identity-headers:
            metrics: false
            patternMatching:
              patterns:
              - predicate: '!("x-maas-username" in request.headers)'
              - predicate: '!("x-maas-group" in request.headers)'
              - predicate: '!("x-maas-keyname" in request.headers)'
              - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)'
              - predicate: '!("x-maas-organization-id" in request.headers)'
              - predicate: '!("x-maas-cost-center" in request.headers)'
              - predicate: '!("x-maas-identity" in request.headers)'
              - predicate: '!("x-maas-admin-scope" in request.headers)'
              - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-"))
              - predicate: request.headers.all(name, !name.startsWith("x-grid-"))
            priority: 0
          guardrail-checks-known:
            metrics: false
            opa:
              allValues: false
              rego: |
                import future.keywords.every

                allow {
                  selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null)
                  selected != null
                  every id, value in selected {
                    id in []
                    value == true
                  }
                }
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
          require-group-membership:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: |-
                allow {
                  object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true
                }
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
          subscription-valid:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            metrics: false
            opa:
              allValues: false
              rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"],
                \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"],
                \"deletionTimestamp\", \"\") == \"\"\n}"
            priority: 0
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
        metadata:
          apiKeyValidation:
            cache:
              key:
                selector: auth.identity.replace("Bearer ", "")
              ttl: 60
            http:
              body:
                expression: '{"key": auth.identity.replace("Bearer ", "")}'
              contentType: application/json
              method: POST
              url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate
            metrics: false
            priority: 0
            when:
            - predicate: auth.identity.matches("^(Bearer ****")
          subscription-info:
            cache:
              key:
                selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username)
                  ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub
                  : auth.identity.user.username))) + "|" + ((has(auth.metadata) &&
                  has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups
                  : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : [])
                  : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                  g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                  : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                  ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                  in request.headers ? request.headers["x-maas-subscription"] : ""))
                  + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                  request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                  x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x
                  != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1]
                  : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   :
                  ""))'
              ttl: 60
            http:
              body:
                expression: |-
                  {
                    "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),
                    "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),
                    "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""),
                    "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers   ? request.headers["x-gateway-model-name"]   : ""))
                  }
              contentType: application/json
              method: POST
              url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select
            metrics: false
            priority: 1
            when:
            - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 &&
                request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x,
                x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers)
        response:
          success:
            filters:
              identity:
                json:
                  properties:
                    groups:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                        ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                        : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                        : []))'
                    groups_str:
                      expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss)
                        ? (has(auth.identity.groups) && auth.identity.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups
                        : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g,
                        g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups
                        : []))).join(",")'
                    keyId:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.keyId : ""'
                    keyName:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.keyName : ""'
                    selected_subscription:
                      expression: 'has(auth.metadata["subscription-info"].name) ?
                        auth.metadata["subscription-info"].name : ""'
                    selected_subscription_id:
                      expression: 'has(auth.metadata["subscription-info"].rateLimitId)
                        ? auth.metadata["subscription-info"].rateLimitId : ""'
                    selected_subscription_key:
                      expression: '(has(auth.metadata["subscription-info"].namespace)
                        && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace
                        + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel)
                        && auth.metadata["subscription-info"].resolvedModel != ""
                        ? auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x,
                        x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0]
                        != "v1" && request.path.split("/").filter(x, x != "")[0] !=
                        "maas-api" ? request.path.split("/").filter(x, x != "")[0]
                        + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name"
                        in request.headers   ? request.headers["x-gateway-model-name"]   :
                        ""))) : ""'
                    subscription_error:
                      expression: 'has(auth.metadata["subscription-info"].error) ?
                        auth.metadata["subscription-info"].error : ""'
                    subscription_error_message:
                      expression: 'has(auth.metadata["subscription-info"].message)
                        ? auth.metadata["subscription-info"].message : ""'
                    subscription_info:
                      expression: 'has(auth.metadata["subscription-info"].name) ?
                        auth.metadata["subscription-info"] : {}'
                    userid:
                      expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                        ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username)
                        ? auth.identity.preferred_username : (has(auth.identity.sub)
                        ? auth.identity.sub : auth.identity.user.username))'
                metrics: true
                priority: 0
                when:
                - predicate: (size(request.path.split("/").filter(x, x != "")) >=
                    2 && request.path.split("/").filter(x, x != "")[0] != "v1" &&
                    request.path.split("/").filter(x, x != "")[0] != "maas-api" ||
                    "x-gateway-model-name" in request.headers)
            headers:
              X-MaaS-Cost-Center:
                metrics: false
                plain:
                  expression: auth.metadata["subscription-info"].costCenter
                priority: 0
                when:
                - predicate: has(auth.metadata["subscription-info"].costCenter) &&
                    auth.metadata["subscription-info"].costCenter != ""
              X-MaaS-Group:
                metrics: false
                plain:
                  expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["''
                    + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]''
                    : ''[]'''
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Group-Token:
                key: X-MaaS-Group
                metrics: false
                plain:
                  expression: 'has(auth.identity.iss) ? (has(auth.identity.groups)
                    && size(auth.identity.groups) > 0 && auth.identity.groups.all(g,
                    g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","''
                    + auth.identity.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')
                    : (has(auth.identity.user.groups) && size(auth.identity.user.groups)
                    > 0 && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/
                    -]+$'')) ? ''["system:authenticated","'' + auth.identity.user.groups.join(''","'')
                    + ''"]'' : ''["system:authenticated"]'')'
                priority: 1
                when:
                - predicate: '!request.headers.authorization.startsWith("Bearer ****")'
              X-MaaS-Identity:
                json:
                  properties:
                    claims:
                      expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub,
                        "aud": auth.identity.aud, "azp": auth.identity.azp, "name":
                        has(auth.identity.name) ? auth.identity.name : "", "given_name":
                        has(auth.identity.given_name) ? auth.identity.given_name :
                        "", "family_name": has(auth.identity.family_name) ? auth.identity.family_name
                        : "", "preferred_username": has(auth.identity.preferred_username)
                        ? auth.identity.preferred_username : "", "email": has(auth.identity.email)
                        ? auth.identity.email : "", "groups": has(auth.identity.groups)
                        ? auth.identity.groups : [], "https://redhat.com/maas/orgs":
                        "https://redhat.com/maas/orgs" in auth.identity ? auth.identity["https://redhat.com/maas/orgs"]
                        : []}'
                    source:
                      value: oidc
                metrics: false
                priority: 0
                when:
                - predicate: "false"
              X-MaaS-KeyName:
                key: x-maas-keyname
                metrics: false
                plain:
                  expression: auth.metadata.apiKeyValidation.keyName
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Subscription:
                metrics: false
                plain:
                  expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation))
                    ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription"
                    in request.headers ? request.headers["x-maas-subscription"] :
                    "")'
                priority: 0
                when:
                - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation)
                    && auth.metadata.apiKeyValidation.subscription != ""
              X-MaaS-Subscription-Rate-Limit-Id:
                metrics: false
                plain:
                  expression: auth.metadata["subscription-info"].rateLimitId
                priority: 0
                when:
                - predicate: has(auth.metadata["subscription-info"].rateLimitId) &&
                    auth.metadata["subscription-info"].rateLimitId != ""
              X-MaaS-Username:
                metrics: false
                plain:
                  selector: auth.metadata.apiKeyValidation.username
                priority: 0
                when:
                - predicate: request.headers.authorization.matches("^Bearer ****")
              X-MaaS-Username-Token:
                key: X-MaaS-Username
                metrics: false
                plain:
                  expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username
                    : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)'
                priority: 1
                when:
                - predicate: '!request.headers.authorization.startsWith("Bearer ****")'
              x-gateway-inference-fairness-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                    : ""'
                priority: 0
              x-gateway-inference-objective:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                    : ""'
                priority: 0
              x-llm-d-inference-fairness-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId
                    : ""'
                priority: 0
              x-llm-d-inference-objective:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective
                    : ""'
                priority: 0
              x-maas-organization-id:
                metrics: false
                plain:
                  expression: 'has(auth.metadata) && "subscription-info" in auth.metadata
                    && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId
                    : ""'
                priority: 0
          unauthenticated:
            body:
              value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}'
            code: 401
            headers:
              content-type:
                value: application/json
            message:
              value: Authentication required
          unauthorized:
            body:
              expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message)
                ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'',
                ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'',
                ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}'''
            code: 403
            headers:
              content-type:
                value: application/json
              x-ext-auth-reason:
                expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error
                  : "unauthorized"'
      strategy: atomic
      when:
      - predicate: request.path != "/maas-api/health" || request.method != "GET"
    targetRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: maas-default-gateway
  status:
    conditions:
    - lastTransitionTime: "2026-11-03T20:08:11Z"
      message: AuthPolicy has been accepted
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2026-11-03T21:29:34Z"
      message: 'AuthPolicy waiting for the following components to sync: [AuthConfig
        (6b6d71a067d8da14c27e332d343507ce689bd147532a52127fecb76527eaea3a) AuthConfig
        (de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb) AuthConfig
        (4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84) AuthConfig
        (ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b) AuthConfig
        (50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7) AuthConfig
        (134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5) AuthConfig
        (eb59e6dcff994e5b4c136619f4ea87029cf16fadbfd43cfd38a94a7b8dda2110) AuthConfig
        (a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14) AuthConfig
        (7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f) AuthConfig
        (6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e) AuthConfig
        (54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd) AuthConfig
        (cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0) AuthConfig
        (5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff) AuthConfig
        (75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c) AuthConfig
        (d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455) AuthConfig
        (f2275301fdae0ced547a71c868e0edc46a6f457efdb16afc596d906b198fafbd) AuthConfig
        (a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b) AuthConfig
        (8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984) AuthConfig
        (17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf) AuthConfig
        (1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4) AuthConfig
        (f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa) AuthConfig
        (2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7) AuthConfig
        (dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5) AuthConfig
        (54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0) AuthConfig
        (2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194) AuthConfig
        (e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07) AuthConfig
        (c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58) AuthConfig
        (0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb) AuthConfig
        (936fa62e791d455e0fb31449b40efbe3e057ef5ffe6a1847639dc0ef1b25f2b7) AuthConfig
        (6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3) AuthConfig
        (d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9) AuthConfig
        (a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe) AuthConfig
        (a9800464506c58f005016df354e160757732171ff4d19747202524955329b998) AuthConfig
        (319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea) AuthConfig
        (c80051f3bc07724b74d7dd29deeb4334c14cfe92cf657ef3b6c863ee97d512f9) AuthConfig
        (e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed) AuthConfig
        (010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a) AuthConfig
        (05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c) AuthConfig
        (23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25) AuthConfig
        (d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b) AuthConfig
        (028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3) AuthConfig
        (98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57)]'
      reason: Unknown
      status: "False"
      type: Enforced
    observedGeneration: 36
- apiVersion: kuadrant.io/v1
  kind: AuthPolicy
  metadata:
    creationTimestamp: "2026-11-03T20:08:25Z"
    generation: 1
    labels:
      app.kubernetes.io/component: llminferenceservice-policies
      app.kubernetes.io/managed-by: odh-model-controller
      app.kubernetes.io/name: llminferenceservice-auth
      app.kubernetes.io/part-of: llminferenceservice
    name: openshift-ai-inference-authn
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: gateway.networking.k8s.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: Gateway
      name: openshift-ai-inference
      uid: 1af2c845-bf9f-4ffe-95ff-699c0ad7ddc4
    resourceVersion: "17357"
    uid: ca5a1ec2-ec84-4d9b-b706-f28501826077
  spec:
    patterns:
      has-ns-and-name:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/[^/]+/[^/]+
      is-publisher-path:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/publishers/[^/]+/models/
    rules:
      authentication:
        kubernetes-user:
          credentials: ****REDACTED****
          kubernetesTokenReview:
            audiences:
            - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/815d9
          metrics: false
          overrides:
            fairness:
              value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/815d9
            objective:
              expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                ? auth.identity.user.username.split('':'')[2] : ''authenticated'''
            resolvedGroups:
              expression: |-
                'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers
                  ? request.headers['x-maas-groups'].split(',')
                  : [])
                : auth.identity.user.groups
            resolvedUser:
              expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user'']
                : auth.identity.user.username'
          priority: 0
      authorization:
        deny-misrouted-model-header:
          metrics: false
          patternMatching:
            patterns:
            - predicate: "false"
          priority: 0
          when:
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'')
              || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))'
          - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')'
        inference-access:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices
              subresource: {}
              verb:
                value: get
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
        inference-access-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '''x-maas-user'' in request.headers'
        model-access-path:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models
              subresource: {}
              verb:
                value: post
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
        model-access-path-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
          - predicate: '''x-maas-user'' in request.headers'
      response:
        success:
          headers:
            x-gateway-inference-fairness-id:
              metrics: false
              plain:
                expression: auth.identity.fairness
              priority: 0
            x-gateway-inference-objective:
              metrics: false
              plain:
                expression: auth.identity.objective
              priority: 0
            x-maas-groups:
              metrics: false
              plain:
                expression: auth.identity.user.groups.join(',')
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-maas-user:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-tenant-id:
              metrics: false
              plain:
                expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                  ? auth.identity.user.username.split('':'')[2] : ''default'''
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
            x-user-id:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
    targetRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: openshift-ai-inference
  status:
    conditions:
    - lastTransitionTime: "2026-11-03T20:08:25Z"
      message: AuthPolicy has been accepted
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2026-11-03T20:08:25Z"
      message: AuthPolicy is not in the path to any existing routes
      reason: Unknown
      status: "False"
      type: Enforced
    observedGeneration: 1
kind: List
metadata:
  resourceVersion: ""