---
title: "How MaaS Governance Wraps a Model Endpoint on AKS"
description: "A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate."
---

# How MaaS Governance Wraps a Model Endpoint on AKS

**Type:** [How it works](https://yomu.fyi/visual-explainers/category/how-it-works.md)

![A four-step left-to-right diagram showing an LLMInferenceService deploying vLLM and a router-scheduler on AKS with an open endpoint, then MaaSSubscription and MaaSAuthPolicy activating an Authorino and Limitador gate that returns 401 or 429 before vLLM, or 200 for authenticated requests.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/601fd6ee-2034-48d8-8c02-144a1905e6e3/image-f59e7624-6fd7-4629-bdc2-9a6f6cedd4ab.webp)

> A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.

## Explanation

Dropping an LLMInferenceService onto an AKS cluster gives you a running vLLM server and a router-scheduler, but the endpoint is open. Governance is a separate layer: applying a MaaSSubscription and a MaaSAuthPolicy activates Authorino, which validates API keys or JWTs, and Limitador, which enforces token rate limits. Requests that fail either check are answered with 401 or 429 before they ever reach vLLM, so rejected traffic never touches the GPU.

## FAQ

### Why is an AKS model endpoint reachable before any MaaS policy is applied?

An LLMInferenceService deploys a vLLM server and a router-scheduler, but it does not add enforcement on its own. The endpoint stays open until a MaaSSubscription and a MaaSAuthPolicy are applied, which is what activates Authorino and Limitador in front of the model.

### Do rejected requests ever reach the model server?

No. Authorino answers missing or invalid keys with 401, and Limitador returns 429 when token rate limits are exceeded, both before the request reaches vLLM. That keeps unauthorized and over-quota traffic off the GPU.

### Should governance live in the model server or in a separate layer?

On AKS the MaaS governance layer sits on top of the inference platform and extends to non-OpenShift Kubernetes distributions, so the vLLM deployment itself does not change. Keeping identity and quota checks in a separate gate lets you add or remove governance without rebuilding the serving stack.

**Tags:** [AI Gateway](https://yomu.fyi/topic/ai-gateway.md), [AKS](https://yomu.fyi/topic/aks.md), [Authentication](https://yomu.fyi/topic/authentication.md), [Azure](https://yomu.fyi/topic/azure.md), [Kubernetes](https://yomu.fyi/topic/kubernetes.md), [Rate Limiting](https://yomu.fyi/topic/rate-limiting.md)

## Related reading

### [Scope workloads and share resilience policies with AWS Resilience Hub](https://yomu.fyi/post/scope-workloads-and-share-resilience-policies-with-aws-resilience-hub.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Sinisa Mikasinovic
- Published: Oct 13, 2026
- Type: Tutorial

AWS Resilience Hub’s Next generation, announced September 18, 2026, adds three capabilities to align workload scope and resilience requirements with running environments. Amazon EKS label support selects Kubernetes resources using existing labels with AND logic, establishing precise resource boundaries without reorganizing namespaces. Generative AI-powered Dependency Insights summarizes discovered dependencies and highlights patterns warranting resilience review, such as cross-Region dependencies questioning recovery design. Resilience policy sharing through AWS Organizations lets a central team define requirements once and make them available to member accounts, with policy events tracking adoption. The post walks through scoping a checkout service on EKS using labels, examining dependencies via synthetic traffic, and applying a shared tier-1-critical policy with a 99.9% availability SLO, 5-minute multi-AZ RTO, 1-minute RPO, 15-minute multi-Region RTO, and 60-minute backup intervals.


### [Why Your Sandbox Never Quite Matches Production (And Why That's Fine)](https://yomu.fyi/post/why-your-sandbox-never-quite-matches-production-and-why-that-s-fine.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Sancharini Panda
- Published: Oct 13, 2026
- Type: Explainer

The gap between sandbox and production environments is structural and inevitable because they change on different schedules with different triggers. Infrastructure divergence rarely affects what integration tests catch, but behavioral contract drift—when simulated upstream responses no longer match real ones—causes tests to pass while production fails. The most effective teams connect simulation updates to upstream deployment events rather than to test failures, using observation-based tools like Keploy that capture real HTTP traffic to keep simulations current. Full production parity is not the goal; targeted accuracy for the specific behavioral contracts that integration tests validate is sufficient to catch the failures that matter most in distributed systems. The sandbox covers what it can, production reveals what it cannot, and the maintenance work is keeping the sandbox’s coverage accurate within its boundary, not expanding it to match production exactly.


### [Under the hood, off the hot path: How D1 scales to millions of databases](https://yomu.fyi/post/under-the-hood-off-the-hot-path-how-d1-scales-to-millions-of-databases.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Lambros Petrou
- Published: Oct 13, 2026
- Type: Explainer

D1, Cloudflare’s serverless SQLite database, has seen 15x growth in live databases over the past year and scales by keeping query execution on the edge in Durable Objects, separate from the control plane’s metadata operations. The control plane uses an Edge API Worker with Hyperdrive to access Postgres clusters for transactional metadata, while Workers KV caches database-to-Durable-Object mappings for fast edge lookups. Database creation completes in about 1.6 seconds by generating a Durable Object ID, persisting metadata to Postgres, and storing the mapping in Workers KV, with the Durable Object lazily initialized on first query. Storage usage enforcement uses atomic counters in Workers KV that are checked locally on each query and updated asynchronously after execution, avoiding any central database round trip during the query. Precomputed aggregations for billing are stored in ClickHouse, and guiding principles such as eventual consistency and idempotency further reduce reliance on centralized components.


### [Red Hat AI Inference 3.5 MaaS governance on AKS](https://yomu.fyi/post/red-hat-ai-inference-3-5-maas-governance-on-aks.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: clobner
- Published: Oct 13, 2026
- Type: Tutorial

Red Hat AI Inference 3.5 extends its Model-as-a-Service (MaaS) governance layer to non-OpenShift Kubernetes distributions, including Azure Kubernetes Service (AKS). MaaS adds multi-tenant API governance on top of the inference platform, controlling authentication, rate limiting, and model access via Authorino and Limitador from Red Hat Connectivity Link (Kuadrant). A model is first deployed with a single LLMInferenceService YAML, creating a vLLM server and router-scheduler, but the endpoint is open. Applying a MaaSSubscription and MaaSAuthPolicy activates governance: Authorino validates API keys or JWTs, and Limitador enforces token rate limits. The post demonstrates three enforcement scenarios on an AKS cluster with a T4 GPU running Qwen3-0.6B: 401 for missing or invalid keys, 200 for authenticated requests, and 429 when rate limits are exceeded, blocking requests before they reach vLLM.