Brent Salisbury nerdalert

Telemetry logging errors in Authorino logs

You can see both metric labels spamming in the kuadrant logs example:

{"level":"error","ts":"2025-11-12T04:08:54Z","logger":"authorino.service.auth.authpipeline","msg":"failed to evaluate CEL expression","request id":"d2beaf26-c088-49c4-82e8-677e594df4eb","expression":"auth.identity.tier","error":"no such key: identity","stacktrace":"github.com/kuadrant/authorino/pkg/service.(*AuthPipeline).metricLabels\n\t/usr/src/authorino/pkg/service/auth_pipeline.go:546\ngithub.com/kuadrant/authorino/pkg/service.(*AuthPipeline).evaluateAuthConfig\n\t/usr/src/authorino/pkg/service/auth_pipeline.go:115\ngithub.com/kuadrant/authorino/pkg/service.(*AuthPipeline).evaluateIdentityConfigs.func1.(*AuthPipeline).evaluateOneAuthConfig.1\n\t/usr/src/authorino/pkg/service/auth_pipeline.go:171\ngithub.com/kuadrant/authorino/pkg/service.(*AuthPipeline).evaluateAuthConfigs.func1\n\t/usr/src/authorino/pkg/service/auth_pipeline.go:162"}
{"level":"error","ts":"2025-11-12T04:08:54Z","logge

MaaS Introspection Architecture

AuthPolicy Summary

Two AuthPolicies manage authentication:

maas-control-plane (deploy/manifests/control-plane-auth-policy.yaml) - JWT auth for admin/management
data-plane-auth-gateway (deploy/manifests/data-plane-introspect.yaml) - API key auth for model inference

Data Plane Call Workflow (Model Endpoint + API Key)

MaaS Platform Quickstart

This guide provides the essential commands for end-to-end validation of the MaaS platform.

Prerequisites

Set environment variables:

export CONTROL_BASE="http://maas.apps.maas2.octo-emerging.redhataicoe.com"

Instructions for enabling and disabling metrics in a running Kuadrant OLM deployment

Load the patched Kuadrant operator:

kubectl -n kuadrant-system patch csv kuadrant-operator.v0.0.0 --type='json' \

llm-d-infra/charts/llm-d-infra/templates/gateway-infrastructure/gatewayparameters.yaml

{{ if and .Values.gateway.enabled (eq .Values.gateway.gatewayClassName "kgateway") .Values.gateway.gatewayParameters.enabled }}
apiVersion: gateway.kgateway.dev/v1alpha1
kind: GatewayParameters
metadata:
  name: {{ include "gateway.fullname" . }}
  labels: {{ include "common.labels.standard" . | nindent 4 }}
    app.kubernetes.io/gateway: {{ include "gateway.fullname" . }}

$ kubectl get envoyfilter --all-namespaces -o yaml
apiVersion: v1
items:
- apiVersion: networking.istio.io/v1alpha3
  kind: EnvoyFilter
  metadata:
    creationTimestamp: "2025-07-10T05:32:40Z"
    generation: 1
    labels:

vLLM Inference Simulator

Repo at llm-d/llm-d-inference-sim

1 . Start the sim container

podman || docker run --rm --net host ghcr.io/llm-d/llm-d-inference-sim \
  --port 8000 \
 --model "Qwen/Qwen2.5-1.5B-Instruct" \

	$ ./deployment/scripts/deploy-openshift.sh
	=========================================
	🚀 MaaS Platform OpenShift Deployment
	=========================================

	📋 Checking prerequisites...

	Required tools:
	- oc: Client Version: 4.8.11
	- jq: jq-1.7

	#!/bin/bash

	# OpenShift MaaS Platform Deployment Script
	# This script automates the complete deployment of the MaaS platform on OpenShift

	set -e

	# Helper function to wait for CRD to be established
	wait_for_crd() {
	local crd="$1"

	$ deployment/scripts/install.sh
	[INFO] Detecting available deployments...
	[INFO] Found deployments: basic gpu simulator
	[INFO] Starting MaaS deployment installation
	[INFO] Using deployment: simulator (simulator-deployment)
	[INFO] Using existing CLUSTER_DOMAIN: apps.maas.octo-emerging.redhataicoe.com
	[INFO] Installing dependencies...
	🔧 Installing all MaaS dependencies...

	🚀 Installing istio...