fix: match HTTPRoute on CR name instead of targetModel for X-Gateway-Model-Name

The HTTPRoute body-routed rules matched X-Gateway-Model-Name against
targetModel, but body-field-to-header sets the header to the ExternalModel
CR name (what /v1/models returns, what clients send). When CR name differs
from targetModel (e.g., company-gpt4 vs gpt-4o), no route matched → 404.

Fix: match on modelName (CR name) instead of ref.targetModel. Routing is
still correct because x-ipp-selected-provider (also in the match) uniquely
identifies the backend. The body model field is still rewritten to
targetModel by model-provider-resolver — the provider receives the correct
model name.

Reverts the header rewrite approach (which would break auth — ipp-pre runs
before the wasm/auth plugin, so overwriting X-Gateway-Model-Name to
targetModel causes Rego model_access lookup and maas-api subscription
validation to fail).

Author: noyitz

pkg/controller/externalmodel/reconciler.go

@@ -317,7 +317,7 @@ func buildHTTPRoute(refs []resolvedRef, modelName, namespace string, port int32,
 			Matches: []gatewayapiv1.HTTPRouteMatch{{
 				Path: &gatewayapiv1.HTTPPathMatch{Type: &pathType, Value: func() *string { s := "/"; return &s }()},
 				Headers: []gatewayapiv1.HTTPHeaderMatch{
-					{Name: "X-Gateway-Model-Name", Type: &headerType, Value: ref.targetModel},
+					{Name: "X-Gateway-Model-Name", Type: &headerType, Value: modelName},
 					{Name: selectedProviderHeader, Type: &headerType, Value: ref.providerName},
 				},
 			}},
@@ -357,7 +357,7 @@ func buildHTTPRoute(refs []resolvedRef, modelName, namespace string, port int32,
 		gatewayapiv1.HTTPRouteRule{
 			Matches: []gatewayapiv1.HTTPRouteMatch{{
 				Headers: []gatewayapiv1.HTTPHeaderMatch{
-					{Name: "X-Gateway-Model-Name", Type: &headerType, Value: refs[0].targetModel},
+					{Name: "X-Gateway-Model-Name", Type: &headerType, Value: modelName},
 				},
 			}},
 			BackendRefs: fallbackBackendRefs,

pkg/controller/externalmodel/reconciler_test.go

@@ -336,9 +336,9 @@ func TestReconcile_TwoModelsOneProvider(t *testing.T) {
 	assert.Equal(t, "shared-provider", string(hr1.Spec.Rules[0].BackendRefs[0].Name))
 	assert.Equal(t, "shared-provider", string(hr2.Spec.Rules[0].BackendRefs[0].Name))
 
-	// Per-provider header match on rule 1 uses targetModel + x-ipp-selected-provider
-	assert.Equal(t, "gpt-4o", hr1.Spec.Rules[1].Matches[0].Headers[0].Value)
-	assert.Equal(t, "gpt-3.5-turbo", hr2.Spec.Rules[1].Matches[0].Headers[0].Value)
+	// Per-provider header match on rule 1 uses CR name + x-ipp-selected-provider
+	assert.Equal(t, "gpt4", hr1.Spec.Rules[1].Matches[0].Headers[0].Value)
+	assert.Equal(t, "gpt35", hr2.Spec.Rules[1].Matches[0].Headers[0].Value)
 
 	// Different path prefixes
 	assert.Equal(t, "/"+ns+"/gpt4", *hr1.Spec.Rules[0].Matches[0].Path.Value)

pkg/plugins/model-provider-resolver/plugin.go

@@ -183,7 +183,6 @@ func (p *ModelProviderResolverPlugin) ProcessRequest(ctx context.Context, cycleS
 	// Drive Envoy routing to the selected provider's backend.
 	request.SetHeader(SelectedProviderHeader, ref.providerName)
 	request.SetHeader("Host", ref.endpoint)
-	request.SetHeader("X-Gateway-Model-Name", ref.targetModel)
 
 	if model != ref.targetModel {
 		request.SetBodyField("model", ref.targetModel)