{"resourceId":"openshift-ai-3-5-known-issues-maas-gateway-llm-d-constraints","versions":[{"version":"external-597745d67d1d46550c3819042618a9e05d4241700b5040e856b88f5d5a207f5e","resource":{"id":"openshift-ai-3-5-known-issues-maas-gateway-llm-d-constraints","title":"Red Hat OpenShift AI Self-Managed 3.5 release notes, Chapter 7 Known issues: MaaS gateway route hijacking, silent rate-limit and scheduler bypass, FIPS limits","organization":"Red Hat","sector":"Cross-sector AI platform (applicable to state, local and higher-education OpenShift AI operators)","geography":"Global","publishedAt":"Undated documentation page (release notes describe OpenShift AI 3.5.2)","publicationDate":null,"eventDate":null,"sourceName":"Red Hat Documentation","sourceLabel":"Vendor product documentation","sourceUrl":"https://docs.redhat.com/en/documentation/red_hat_openshift_ai_self-managed/3.5/html/release_notes/known-issues_relnotes","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure","operating-model"],"finding":"Source finding (vendor-documented defects): Red Hat lists known issues in OpenShift AI 3.5 that affect governed model serving. RHOAIENG-80360: default Gateway settings such as allowedRoutes.namespaces.from: All let a user with standard namespace-level permissions attach an HTTPRoute that intercepts traffic to a legitimate model endpoint, exposing API keys, prompts and responses. RHOAIENG-76586: with Red Hat Connectivity Link 1.4.0/1.4.1, rate limiting for batch gateways silently stops. INFERENG-6962: any extra HTTPRoute on a wildcard listener bypasses the llm-d EndpointPicker, silently disabling prefix-cache and load-aware scheduling. RHOAIENG-71638: MaaS returns HTTP 500/503 under high concurrency due to a 200 ms auth timeout (affects 3.4 and 3.5). RHOAIENG-58765: llm-d prefill/decode disaggregation fails on FIPS-enabled clusters in 3.4 EA2. RHOAIENG-82694: MCP Lifecycle Operator can run out of memory on large clusters, with no workaround. Workarounds are documented for most items.","sledRelevance":"Directly relevant to state agencies, counties and universities considering OpenShift AI Models-as-a-Service as a shared, multi-department model gateway: the documented route-hijack risk and silent rate-limit failure bear on tenant isolation and chargeback, and FIPS constraints matter for CJIS- or federal-data-adjacent environments. Why now: the 5 Nov Red Hat/NVIDIA AI Factory expansion (archived) promotes a MaaS + AI gateway reference design with access policies and rate limits; these known issues define the operating conditions for that design. Not previously archived.","evidence":"Vendor product documentation listing defect IDs, symptoms, affected versions and workarounds. No exploitation reports, prevalence data or severity scores are given on this page.","architectureImplications":"Shared model gateways must use label-based namespace selectors for route attachment, keep non-LLM routes off the inference gateway listener, pin or work around Connectivity Link versions, and raise auth timeouts for concurrency. Kueue-integrated training must stay on an unsupported RHBoK 1.3 for Kubeflow Trainer v2 integration.","governanceImplications":"Silent failures (rate limits, intelligent scheduling) mean governance controls can appear configured while not enforced; acceptance testing must verify enforcement, e.g., the documented 429 test.","securityPrivacyImplications":"Route hijacking enables interception of API keys, user prompts and model responses by non-privileged namespace users on a misconfigured shared gateway, a material multi-tenant confidentiality risk.","caveats":"Undated living documentation; contents can change as fixes ship. Some items are from early-access builds (EA1/EA2) and may not apply to GA deployments. Vendor-reported; no independent validation or incident data. Severity and exploitability are not rated here.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: use these known issues to build trust, not to undermine the platform. Public-sector buyers evaluating OpenShift AI as a shared model service will ask about tenant isolation and enforcement; Red Hat documents both the risks and the workarounds. Position a hardening and validation engagement alongside any MaaS deployment, and avoid claiming that gateway rate limits, chargeback or isolation work out of the box without configuration and testing.","engineering":"Engineering framing: treat Chapter 7 as a pre-deployment checklist. Configure label-based allowedRoutes on MaaS and llm-d gateways, keep other HTTPRoutes off the wildcard inference listener, verify EndpointPicker activity in logs, pin Connectivity Link 1.3.5 or apply the documented memory and identity-filter fixes, and set AUTH_SERVICE_TIMEOUT for concurrency. On FIPS clusters, confirm prefill/decode disaggregation support in the deployed build before designing around it.","delivery":"Delivery framing: several failures are silent, so acceptance tests must prove controls work rather than check configuration. Include a 429 rate-limit test, a route-attachment test from an unprivileged namespace, EndpointPicker log checks and a concurrency load test in the runbook. Track known-issue status at each upgrade, and assign an owner to review release notes before every OpenShift AI or Connectivity Link version change."},"roleDetails":{"sales":{"customerProblem":"Agencies want a shared, governed model service across departments but need assurance that isolation, rate limits and chargeback controls are enforced.","stakeholders":["CISO / security architect","Enterprise AI platform owner","Department application owners consuming models","Internal audit"],"discoveryQuestions":["Will multiple departments or tenants share one model gateway?","Is the cluster FIPS-enabled or subject to CJIS or similar requirements?","How will rate limits and usage chargeback be verified?","Which OpenShift AI and Connectivity Link versions are deployed or planned?"],"valueHypothesis":"A hardening and validation package reduces the risk of a misconfigured shared model gateway exposing prompts or failing to enforce limits.","potentialEngagement":"A bounded MaaS gateway hardening review and acceptance-test build-out against the documented 3.5 known issues.","unsupportedClaims":["That OpenShift AI MaaS is secure by default for multi-tenant use","That the issues have been exploited","That all listed issues affect GA deployments"]},"engineering":{"fit":"Applies to any OpenShift AI 3.4/3.5 deployment using MaaS, llm-d distributed inference, Connectivity Link or FIPS mode.","architectureIntegration":"Gateway API configuration for MaaS and llm-d, Kuadrant/Authorino policies via Red Hat Connectivity Link, Istio from OpenShift Service Mesh, and Kueue for training.","prerequisites":["Inventory of OpenShift AI, RHCL, OSSM and RHBoK versions","Namespace labeling scheme","Load-testing tooling","Log access for EndpointPicker"],"constraints":["RHBoK 1.3 required for Trainer v2 + Kueue but unsupported and unavailable on OCP 4.22","MCP Lifecycle Operator OOM has no workaround","FIPS clusters cannot use P/D disaggregation in 3.4 EA2"],"security":"Enforce label-based route attachment to prevent route hijacking; verify identity filters so rate limits bind to authenticated users.","proofOfValue":["Attempt HTTPRoute attachment from an unlabeled namespace and confirm rejection","Run the documented 429 rate-limit loop","Confirm EndpointPicker per-request log activity","Load test MaaS at target concurrency for 500/503 errors"]},"delivery":{"work":"Harden gateway configuration, implement workarounds, and embed verification tests into deployment and upgrade runbooks.","dependencies":["Platform and security teams","Version pinning decisions for RHCL and RHBoK","Red Hat support for fix timelines"],"ownership":"AI platform operations team, with security architecture sign-off.","skillsAdoption":"Teams need Gateway API, Kuadrant/Authorino and Istio troubleshooting skills in addition to OpenShift AI administration.","governanceCheckpoints":["Security review of gateway route-attachment policy","Release-note review before each upgrade","Post-deployment control-enforcement test sign-off"],"acceptanceCriteria":["Proposed: unprivileged namespace cannot attach routes to the model gateway","Proposed: rate limit returns 429 at the configured threshold","Proposed: no 500/503 errors at planned peak concurrency"],"risks":["Silent control failure after upgrades","Unsupported component versions pinned for workarounds","Operator OOM on large shared clusters"]}},"retrievedAt":"2026-11-07T22:08:30-06:00","enrichedAt":"2026-11-07T22:12:38-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Raises the skill bar for small public-sector platform teams operating shared AI gateways.","procurementImplications":"Buyers should require vendor or integrator acceptance tests that demonstrate isolation and rate-limit enforcement, not configuration screenshots.","operatingModelImplications":"Shared model services need an operator role that tracks known issues and re-verifies controls at each upgrade.","sourceVerification":{"openedUrl":"https://docs.redhat.com/en/documentation/red_hat_openshift_ai_self-managed/3.5/html/release_notes/known-issues_relnotes","referenceExcerpt":"This allows unauthorized interception of sensitive data, such as API keys, user prompts, and model responses, without requiring elevated privileges.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}