{"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","reconcileID":"62fd4409-574c-436d-a772-c8dc624c3589","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","event":"UPDATE"} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"} {"level":"info","ts":"2026-11-04T01:48:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:48:48.429Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":2}} {"level":"info","ts":"2026-11-04T01:48:48.693Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:48:48.695Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:48:48.695Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:48.700Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:48:48.701Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:48:48.702Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:48:48.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.065Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.065Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.135Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy"],"eventTypes":{"create":1,"update":1}} {"level":"info","ts":"2026-11-04T01:48:49.162Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.173Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:48:49.300Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:48:49.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.350Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"} {"level":"info","ts":"2026-11-04T01:48:49.460Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:48:49.461Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.461Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.465Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.466Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:48:49.466Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:49.467Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-11-04T01:48:49.473Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-b1e8de2d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ait-b1e8de2d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-b1e8de2d","uid":"47282f39-1137-4b8b-a342-242361f12892"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-b1e8de2d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-b1e8de2d\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.478Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.494Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.566Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.585Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-b1e8de2d#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-b1e8de2d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.664Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-b1e8de2d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ait-b1e8de2d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-b1e8de2d","uid":"47282f39-1137-4b8b-a342-242361f12892"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"60e86d65aee7ebd9326bf99b8bfa70ce9154c433c94a21fb8f833b19afebc582\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"e54f3c0c88708dbffbec77ce51b95f14688c8838d587f902ccf5869bc94f17dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"54107575fda98b4aa62dd729766caea995c337ace0800f4f6ea3108e36b3d9c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"42af4acf5546ef6f1e80d502c4aa65316ff6646be780a01372f5dd6e2f064922\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"1e3e587e2851aed7681681e5c67f84e620ee825005366b8387c8e407d5ebd483\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-b1e8de2d-maas-auth\"]}],\"name\":\"c25f7bc274bf106bc7e20188bfa6e75c8d6b89b424cdb0aba2cf3d75c56f5538\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\",\"metrics.labels.tenant_name\":\"\\\"e2e-ait-b1e8de2d\\\"\",\"metrics.labels.tenant_namespace\":\"\\\"ai-tenant-e2e-ait-b1e8de2d\\\"\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-b1e8de2d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-b1e8de2d\" already exists"} {"level":"error","ts":"2026-11-04T01:48:49.669Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-b1e8de2d","namespace":"openshift-ingress","uid":"932d715e-e6fe-47a4-be3d-2edd74810d57","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-b1e8de2d\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:48:49.674Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"100ce154-61d4-4b65-a929-1b3b9ee47182","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:48:49.679Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"e9210f5a-e361-465b-a4e2-160a36bb9c75","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:48:49.711Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-b1e8de2d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-b1e8de2d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:48:49.712Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:48:49.712Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"error","ts":"2026-11-04T01:48:49.719Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ait-b1e8de2d","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ait-b1e8de2d\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:48:49.749Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-b1e8de2d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-b1e8de2d\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:48:50.982Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","EnvoyFilter","AuthPolicy","Gateway","Limitador","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":9,"update":8}} {"level":"info","ts":"2026-11-04T01:48:51.016Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:48:51.180Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:48:51.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:48:51.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:51.399Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:48:51.400Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:48:51.400Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:51.416Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:48:51.417Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:48:51.417Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:48:51.417Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:48:51.712Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:48:51.712Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","reconcileID":"7fdd257c-8714-4664-ac7b-bf61799accd6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","event":"UPDATE"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":6} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","reconcileID":"7fdd257c-8714-4664-ac7b-bf61799accd6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"} {"level":"error","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-b1e8de2d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","reconcileID":"dfa3cc07-9caf-4635-a72f-8c62b2d8ca21","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-b1e8de2d\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-b1e8de2d","event":"DELETE"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"error","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-b1e8de2d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"} {"level":"info","ts":"2026-11-04T01:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:49:12.619Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","TokenRateLimitPolicy","Kuadrant","AuthPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":6}} {"level":"info","ts":"2026-11-04T01:49:12.635Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:12.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:49:12.692Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:12.760Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:12.782Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:49:12.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:12.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:12.874Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:12.892Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:12.893Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:12.893Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:12.894Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:49:12.900Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:12.905Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:13.115Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:13.115Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:13.182Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","Gateway"],"eventTypes":{"delete":5}} {"level":"info","ts":"2026-11-04T01:49:13.378Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:13.378Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:13.380Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:49:13.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:13.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:13.388Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-11-04T01:49:13.399Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:49:13.399Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"error","ts":"2026-11-04T01:49:13.399Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248","error":"authconfigs.authorino.kuadrant.io \"dc761c8fb970d12a67e21f703cc8e8bc0313cc71312d8f0f981da08d3b0e4248\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.451Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3","error":"authconfigs.authorino.kuadrant.io \"978b331c32eb21b984a8fbb5a16b399f0d0d2657c9b78f6243c49940b6428ca3\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54","error":"authconfigs.authorino.kuadrant.io \"a48496b7509290154ac678d22a8cb3152f4d740abdb4e104f8cd1add653c6b54\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.459Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0","error":"authconfigs.authorino.kuadrant.io \"07c2454d772e66c6bf058c26a5334d759b5ed4a245729bb43de39020b996aec0\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.463Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91","error":"authconfigs.authorino.kuadrant.io \"c359125f2796bd93ca1948ddae0164f7188f03058aaa254ca77b1221441e4d91\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c","error":"authconfigs.authorino.kuadrant.io \"d48b799fa74eb2a631a3bf125acb6856f7873949a800ebd1532f6f084087df2c\" not found"} {"level":"error","ts":"2026-11-04T01:49:13.593Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"100ce154-61d4-4b65-a929-1b3b9ee47182","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:13.600Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"e9210f5a-e361-465b-a4e2-160a36bb9c75","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:49:13.632Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:13.632Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:15.497Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","Limitador","AuthConfig"],"eventTypes":{"create":1,"delete":6,"update":4}} {"level":"info","ts":"2026-11-04T01:49:15.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:49:15.600Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:49:15.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:15.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:15.784Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:15.785Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:15.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:15.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:15.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:15.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:15.793Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:16.070Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:16.070Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:16.138Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}} {"level":"info","ts":"2026-11-04T01:49:16.375Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:16.379Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:16.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:16.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:16.382Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:16.382Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:16.384Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-11-04T01:49:16.581Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"100ce154-61d4-4b65-a929-1b3b9ee47182","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:16.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"e9210f5a-e361-465b-a4e2-160a36bb9c75","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:49:16.612Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:16.612Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:17.328Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","TokenRateLimitPolicy"],"eventTypes":{"update":4}} {"level":"info","ts":"2026-11-04T01:49:17.344Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:49:17.389Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:49:17.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:17.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:17.568Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:17.569Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:17.569Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:17.569Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:17.569Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:17.570Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:17.759Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:17.759Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","reconcileID":"f84cfabb-9e3b-4ebd-ba4f-56ba81efe106","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","event":"CREATE"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","reconcileID":"2315ab95-9f0e-40c6-99ff-ffd32706db6c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","event":"UPDATE"} {"level":"info","ts":"2026-11-04T01:49:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","reconcileID":"5699f8d7-012e-46ab-9651-519387846cd7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","event":"UPDATE"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"} {"level":"info","ts":"2026-11-04T01:49:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:49:20.219Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","ConfigMap","Gateway"],"eventTypes":{"create":2,"update":2}} {"level":"info","ts":"2026-11-04T01:49:20.577Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:20.577Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:20.578Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:49:20.580Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:20.581Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:20.581Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:20.592Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:20.998Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:20.998Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:21.074Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy"],"eventTypes":{"create":1,"update":1}} {"level":"info","ts":"2026-11-04T01:49:21.098Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:21.102Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:49:21.187Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:49:21.255Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:21.255Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:21.255Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:21.277Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:21.494Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:21.494Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:21.494Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:21.497Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:21.502Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:21.502Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:21.505Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"error","ts":"2026-11-04T01:49:21.516Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-authcfg-http-442e8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-authcfg-http-442e8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-authcfg-http-442e8c","uid":"57d6d20c-e3d6-4d19-ad2c-e3460acb22a3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-authcfg-http-442e8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-authcfg-http-442e8c\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.518Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7c2008cd51d835f8f907c8744a9da745281cc3f9c246b0b42275c4195383e6ac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c2008cd51d835f8f907c8744a9da745281cc3f9c246b0b42275c4195383e6ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7c2008cd51d835f8f907c8744a9da745281cc3f9c246b0b42275c4195383e6ac\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.549Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c2d0d48979b5d1e244976ba547b3a17887dd2ed2ed2305452804ef36b4380b0c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c2d0d48979b5d1e244976ba547b3a17887dd2ed2ed2305452804ef36b4380b0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c2d0d48979b5d1e244976ba547b3a17887dd2ed2ed2305452804ef36b4380b0c\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.594Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6a778ed42a9c4ec981daddbfa4316e41b3fc9f29d149d49054b9986b0c15b754","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6a778ed42a9c4ec981daddbfa4316e41b3fc9f29d149d49054b9986b0c15b754"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6a778ed42a9c4ec981daddbfa4316e41b3fc9f29d149d49054b9986b0c15b754\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.615Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ed88ee0f8b5e92fa4683fc56ef5f7d998d8f6bbe936faa2cca6c5727bae1ec72","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed88ee0f8b5e92fa4683fc56ef5f7d998d8f6bbe936faa2cca6c5727bae1ec72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ed88ee0f8b5e92fa4683fc56ef5f7d998d8f6bbe936faa2cca6c5727bae1ec72\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2b73f30d3ed2332048b56e4bbd7f9e7946e19683d76ce518827640b439c0a647","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b73f30d3ed2332048b56e4bbd7f9e7946e19683d76ce518827640b439c0a647"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2b73f30d3ed2332048b56e4bbd7f9e7946e19683d76ce518827640b439c0a647\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.669Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"16bd0c57dd368398ed2f89602191687d9d721412fd00a4f531b9193da5f1d674","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16bd0c57dd368398ed2f89602191687d9d721412fd00a4f531b9193da5f1d674"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"16bd0c57dd368398ed2f89602191687d9d721412fd00a4f531b9193da5f1d674\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4c8fb359cdb390100d9999992038ddfde5144cfff45a0d303238326b00d2acb6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c8fb359cdb390100d9999992038ddfde5144cfff45a0d303238326b00d2acb6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4c8fb359cdb390100d9999992038ddfde5144cfff45a0d303238326b00d2acb6\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"37dee361dacdcc22d5d960ce57e25e5044308373d23b221d6f3acadc92e41a4f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37dee361dacdcc22d5d960ce57e25e5044308373d23b221d6f3acadc92e41a4f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"37dee361dacdcc22d5d960ce57e25e5044308373d23b221d6f3acadc92e41a4f\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.723Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"868fe1de86f93db042414a9e4e5755498fef2aa396b93232e2396427479c300c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["868fe1de86f93db042414a9e4e5755498fef2aa396b93232e2396427479c300c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"868fe1de86f93db042414a9e4e5755498fef2aa396b93232e2396427479c300c\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.734Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-authcfg-http-442e8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-authcfg-http-442e8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-authcfg-http-442e8c","uid":"57d6d20c-e3d6-4d19-ad2c-e3460acb22a3"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37dee361dacdcc22d5d960ce57e25e5044308373d23b221d6f3acadc92e41a4f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"1ecda0df9b9d57d0da480e767f4b1610b3b61d3f66eb4e119bba8d332af21000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c8fb359cdb390100d9999992038ddfde5144cfff45a0d303238326b00d2acb6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"4b7acbc891aebb4c875063183ee04cb0666b38adf049e26a4ceb3b95498ad404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"868fe1de86f93db042414a9e4e5755498fef2aa396b93232e2396427479c300c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"098c9c0dbf1a02ac9d5b1c37c4cdf12d38f52b4ac9a4c2e96f5e71a2f03c975f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c2008cd51d835f8f907c8744a9da745281cc3f9c246b0b42275c4195383e6ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"3af8d74881dbb34ccb9aeb5a79fb383a0b04fd873dac86624fb016095f3a7bfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70a7f1b0410e5e564dade567fd3d2e9586691a470f4ef4237d28063ac9bcaa81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"4109bb4f4995f7901a8ef6cdd0f3eed532dfeef25d90a0fdd4fdb62014afd93f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3b2ccaec85019e5c73d4053d5ea9ed84990046307ea10f21678d02e94f0c67bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"bdf7ec97eede99d727a77f1426daf69ab304c9c861ef5ef304841b17c2d6f99b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bd0c57dd368398ed2f89602191687d9d721412fd00a4f531b9193da5f1d674\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"6c43ed7f610e4c51dfc023609d96dc7b049fa383c3c82c06e33f6fe51d1418e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75313733007b2543555130426c1a647f97620264148aa974d7ce0a6ba9f2067e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"908e9761398f08f24bd0fabafbbf8e8ee64c5065f1e12c12e3b92b2d827bb243\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6a778ed42a9c4ec981daddbfa4316e41b3fc9f29d149d49054b9986b0c15b754\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"98cfd5960384f37c12dea61b7b4db9cf1e2631622f9fcb9a3abc7eb6661fad9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed88ee0f8b5e92fa4683fc56ef5f7d998d8f6bbe936faa2cca6c5727bae1ec72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"e05743630ea5c0ed47fe07af186b0c6cad9285ec09d630b799bae0c26ba3c2eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b73f30d3ed2332048b56e4bbd7f9e7946e19683d76ce518827640b439c0a647\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"bb332a0f201d7cf95db5de1cce1bd9c6434fa9c9edef9e881df129671e2499ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c2d0d48979b5d1e244976ba547b3a17887dd2ed2ed2305452804ef36b4380b0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-authcfg-http-442e8c-maas-auth\"]}],\"name\":\"885fe6bf502b4742b23ca2cd4a625876c8ee8aea14bd8f9e0fac2bf36e5f1bd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\",\"metrics.labels.tenant_name\":\"\\\"e2e-authcfg-http-442e8c\\\"\",\"metrics.labels.tenant_namespace\":\"\\\"ai-tenant-e2e-authcfg-http-442e8c\\\"\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-authcfg-http-442e8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-authcfg-http-442e8c\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3b2ccaec85019e5c73d4053d5ea9ed84990046307ea10f21678d02e94f0c67bd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3b2ccaec85019e5c73d4053d5ea9ed84990046307ea10f21678d02e94f0c67bd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3b2ccaec85019e5c73d4053d5ea9ed84990046307ea10f21678d02e94f0c67bd\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.758Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75313733007b2543555130426c1a647f97620264148aa974d7ce0a6ba9f2067e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75313733007b2543555130426c1a647f97620264148aa974d7ce0a6ba9f2067e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75313733007b2543555130426c1a647f97620264148aa974d7ce0a6ba9f2067e\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.776Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-442e8c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"70a7f1b0410e5e564dade567fd3d2e9586691a470f4ef4237d28063ac9bcaa81","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer **** && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["70a7f1b0410e5e564dade567fd3d2e9586691a470f4ef4237d28063ac9bcaa81"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-authcfg-http-442e8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers ? request.headers[\"x-gateway-model-name\"] : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"70a7f1b0410e5e564dade567fd3d2e9586691a470f4ef4237d28063ac9bcaa81\" already exists"} {"level":"error","ts":"2026-11-04T01:49:21.783Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"100ce154-61d4-4b65-a929-1b3b9ee47182","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:21.789Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"e9210f5a-e361-465b-a4e2-160a36bb9c75","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:21.790Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-authcfg-http-442e8c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-authcfg-http-442e8c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:21.808Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-authcfg-http-442e8c","namespace":"openshift-ingress","uid":"2733f326-ad14-4afc-a967-553655603ec1","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-authcfg-http-442e8c\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:49:21.829Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:21.829Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"error","ts":"2026-11-04T01:49:21.857Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-authcfg-http-442e8c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-authcfg-http-442e8c\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"error","ts":"2026-11-04T01:49:21.862Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-authcfg-http-442e8c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-authcfg-http-442e8c\": the object has been modified; please apply your changes to the latest version and try again"} {"level":"info","ts":"2026-11-04T01:49:23.167Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Limitador","EnvoyFilter","ConfigMap","Gateway","HTTPRoute","AuthPolicy"],"eventTypes":{"create":15,"update":8}} {"level":"info","ts":"2026-11-04T01:49:23.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:49:23.268Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:49:23.285Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:49:23.285Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:23.608Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:23.609Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:23.609Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:23.618Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:23.620Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:23.620Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:23.621Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:23.901Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:49:23.901Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:32.940Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"update":5}} {"level":"info","ts":"2026-11-04T01:49:33.350Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:33.351Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:49:33.353Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:49:33.353Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:33.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:33.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:49:35.324Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy"],"eventTypes":{"update":14}} {"level":"info","ts":"2026-11-04T01:49:35.704Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:49:35.705Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:49:35.705Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:50:52.681Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy"],"eventTypes":{"update":2}} {"level":"info","ts":"2026-11-04T01:50:52.989Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:50:52.991Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:50:52.991Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:50:54.565Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy"],"eventTypes":{"update":14}} {"level":"info","ts":"2026-11-04T01:50:54.794Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:50:54.795Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:50:54.795Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","reconcileID":"61d09c68-8ce3-4681-bf90-f02967639e98","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","event":"UPDATE"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":6} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","reconcileID":"61d09c68-8ce3-4681-bf90-f02967639e98","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-authcfg-http-442e8c","namespace":"openshift-ingress"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-authcfg-http-442e8c","event":"DELETE"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"} {"level":"error","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-authcfg-http-442e8c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"} {"level":"info","ts":"2026-11-04T01:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"} {"level":"info","ts":"2026-11-04T01:50:59.923Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Kuadrant","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":4}} {"level":"info","ts":"2026-11-04T01:50:59.973Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:00.067Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:00.067Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:00.067Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:00.162Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:00.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:00.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:00.265Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:00.266Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:00.266Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:00.267Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:00.271Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:51:00.289Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:00.300Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:00.549Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:00.549Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:01.554Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","Gateway","AuthPolicy","ConfigMap","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":15,"update":6}} {"level":"info","ts":"2026-11-04T01:51:01.568Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:01.588Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:01.692Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:01.692Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:01.781Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:01.797Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:01.797Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:01.797Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:01.799Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:01.799Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:01.849Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:02.025Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:02.025Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:02.577Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":4}} {"level":"info","ts":"2026-11-04T01:51:02.592Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:02.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:02.695Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:02.695Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:02.868Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:02.869Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:02.869Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:02.870Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:02.870Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:02.870Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:03.032Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:03.032Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:05.726Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy"],"eventTypes":{"delete":1,"update":1}} {"level":"info","ts":"2026-11-04T01:51:05.967Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:05.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:05.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:06.266Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"delete":1}} {"level":"info","ts":"2026-11-04T01:51:06.488Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:06.488Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:06.488Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:06.497Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:06.499Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:06.499Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:06.500Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:06.731Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:06.731Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:07.274Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":1,"update":1}} {"level":"info","ts":"2026-11-04T01:51:07.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:07.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:07.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:07.554Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:51:07.564Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:09.330Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","HTTPRoute"],"eventTypes":{"update":7}} {"level":"info","ts":"2026-11-04T01:51:09.348Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:09.504Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:09.550Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:09.550Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:09.823Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:09.840Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:09.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:09.849Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:09.851Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:09.851Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:09.861Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:10.186Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:10.186Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:11.072Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}} {"level":"info","ts":"2026-11-04T01:51:11.093Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:11.247Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:11.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:11.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:11.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:11.486Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:11.486Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:11.486Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:11.486Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:11.486Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:11.725Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:11.725Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:13.312Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"update":2}} {"level":"info","ts":"2026-11-04T01:51:13.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:13.551Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:51:13.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:13.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:13.563Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:15.367Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":6}} {"level":"info","ts":"2026-11-04T01:51:15.388Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:15.480Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:15.529Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:15.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:15.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:15.893Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:15.893Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:15.893Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:15.893Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:15.893Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:16.263Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:16.263Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:17.201Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}} {"level":"info","ts":"2026-11-04T01:51:17.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:17.313Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:17.378Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:17.378Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:17.685Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:17.688Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:17.688Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:17.688Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:17.688Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:17.688Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:17.925Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:17.925Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:29.103Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":2}} {"level":"info","ts":"2026-11-04T01:51:29.359Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:29.361Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:29.361Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:29.361Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:51:29.371Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:30.746Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":6}} {"level":"info","ts":"2026-11-04T01:51:30.762Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:30.854Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:30.980Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:30.980Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:30.992Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:30.993Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:30.993Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:30.993Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:30.993Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:30.993Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:31.294Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:31.294Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:32.844Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"update":6}} {"level":"info","ts":"2026-11-04T01:51:32.893Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:32.973Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:33.017Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:33.018Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:33.275Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:33.280Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:33.280Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:33.277Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:33.280Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:33.277Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:33.651Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:33.651Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:45.716Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"update":2}} {"level":"info","ts":"2026-11-04T01:51:45.949Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:45.954Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:45.954Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:45.957Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:45.957Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:46.765Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","EnvoyFilter"],"eventTypes":{"update":3}} {"level":"info","ts":"2026-11-04T01:51:46.978Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:46.978Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:46.979Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:46.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:46.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:56.465Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":1}} {"level":"info","ts":"2026-11-04T01:51:56.754Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:56.755Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:56.755Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:56.755Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"} {"level":"info","ts":"2026-11-04T01:51:56.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:58.688Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","ConfigMap","Limitador","EnvoyFilter"],"eventTypes":{"update":6}} {"level":"info","ts":"2026-11-04T01:51:58.711Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:51:58.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:51:58.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:51:58.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:59.185Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:59.186Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:51:59.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:51:59.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:59.191Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:51:59.191Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:51:59.205Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:51:59.560Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:51:59.560Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"} {"level":"info","ts":"2026-11-04T01:52:00.117Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":4}} {"level":"info","ts":"2026-11-04T01:52:00.133Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"} {"level":"info","ts":"2026-11-04T01:52:00.157Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"} {"level":"info","ts":"2026-11-04T01:52:00.262Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"} {"level":"info","ts":"2026-11-04T01:52:00.262Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"} {"level":"info","ts":"2026-11-04T01:52:00.369Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"} {"level":"info","ts":"2026-11-04T01:52:00.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"} {"level":"info","ts":"2026-11-04T01:52:00.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"} {"level":"info","ts":"2026-11-04T01:52:00.370Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"} {"level":"info","ts":"2026-11-04T01:52:00.370Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"} {"level":"info","ts":"2026-11-04T01:52:00.370Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"} {"level":"info","ts":"2026-11-04T01:52:00.540Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"} {"level":"info","ts":"2026-11-04T01:52:00.540Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}