Bug: RBAC verb mismatch in MaaS tier Role reconciler (3.3) — AuthPolicy checks 'get' but Role grants 'post'

[amasolov]

Bug Description

In RHOAI/ODH 3.3, the gateway AuthPolicy template and the auto-created RBAC Role use different verbs for the SubjectAccessReview on llminferenceservices. This causes 403 PERMISSION_DENIED: "not authorized: unknown reason" when maas-api probes model endpoints to build the model list.

Root Cause

AuthPolicy template (internal/controller/resources/template/authpolicy_llm_isvc_userdefined.yaml lines 37-38) checks:

verb:
  value: get

Role reconciler (internal/controller/serving/reconcilers/llm_role_reconciler.go lines 91-92) creates Roles with:

Verbs: []string{"post"},

Because the verbs don't match, the Kubernetes SubjectAccessReview always fails — the tier SA has post permission but the AuthPolicy asks "can this SA get llminferenceservices?"

Impact

• GET /maas-api/v1/models returns {"data":null,"object":"list"} (empty model list)
• The internal probes from maas-api to individual model endpoints all receive 403 Forbidden
• Authorino logs show: "authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"message":"not authorized: unknown reason"}

Affected Versions

• ODH v3.3 / RHOAI 3.3 — the Role reconciler existed with this bug
• ODH v3.4+ — the Role reconciler was removed in fix: removing maas-realted webhooks, authpolicy and tiers #713 / feat: cleanup for migration 3.3 to 3.4 (MaaS related) #724, so this no longer applies (but 3.3 users who haven't upgraded are affected)

Workaround

Manually create a Role and RoleBinding with the correct verb (get) using a different name so the controller doesn't overwrite it:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: llminferenceservice-inference-get
  namespace: <model-namespace>
rules:
  - apiGroups: ["serving.kserve.io"]
    resources: ["llminferenceservices"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tier-sa-inference-get
  namespace: <model-namespace>
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: system:serviceaccounts:maas-default-gateway-tier-<tier-name>
roleRef:
  kind: Role
  apiGroup: rbac.authorization.k8s.io
  name: llminferenceservice-inference-get

Using a different resource name avoids the controller's reconciliation loop (which only manages *-model-post-access / *-model-post-access-tier-binding).

Related

• The MaaS tier configuration docs also show verbs: ["post"] in the manual RBAC example — filing a separate fix in opendatahub-io/models-as-a-service.

[spolti]

Hi, please move this issue into a jira.