{"level":"debug","ts":"2026-07-06T01:58:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"debug","ts":"2026-07-06T01:58:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca26ca792309619dd45f7dc6b8e6737264ad19acfe94e2d09c0e81c803609dc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca26ca792309619dd45f7dc6b8e6737264ad19acfe94e2d09c0e81c803609dc1"}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76d3c3446ffdc7566c49a3522dc3952895c468d9b97221193c2b8d448406dc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76d3c3446ffdc7566c49a3522dc3952895c468d9b97221193c2b8d448406dc13"}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"116a47c36c99c22908c876036b760c7acbde5afc0967c5edfa0b14bf7e3cd894","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/116a47c36c99c22908c876036b760c7acbde5afc0967c5edfa0b14bf7e3cd894"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b92b96f594d0b92cf6c26b05bb0c00bc241778056e27bcf5fc0457ad3aeef4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b92b96f594d0b92cf6c26b05bb0c00bc241778056e27bcf5fc0457ad3aeef4b"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee"}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"}
{"level":"info","ts":"2026-07-06T01:58:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f68a636ce276a6fc6d481a517e37d423335d9f87dbd7369439161b3138a7a93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f68a636ce276a6fc6d481a517e37d423335d9f87dbd7369439161b3138a7a93"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c255d5732cc9729f58f35b28e2bf8201c0d3f3f1b7cd9e6c3eac1e337f17495","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1209c87f4164685e05d402f073be6d9a253a21d48deb41959a14ea75b044f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c255d5732cc9729f58f35b28e2bf8201c0d3f3f1b7cd9e6c3eac1e337f17495"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1209c87f4164685e05d402f073be6d9a253a21d48deb41959a14ea75b044f97d"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d4322859bcd3aac0fd8d9fc95345073361d4796665e2612484d8e0366e1fae05","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4526d7c88bcba85c0296e848c16c6a5edcc2e1cfca8df1a325352bada305b360","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T01:58:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7260d6ca721808c5970414fc1ed81eea03d8e9b82bb9b358231605549e6b86dc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d4322859bcd3aac0fd8d9fc95345073361d4796665e2612484d8e0366e1fae05"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4526d7c88bcba85c0296e848c16c6a5edcc2e1cfca8df1a325352bada305b360"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"706fd5933926a56babac5b7ab1078d8ef5f8e98ee328dd41230817a9b45e798d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7260d6ca721808c5970414fc1ed81eea03d8e9b82bb9b358231605549e6b86dc"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"337fb4f9a0608cd0f60a50bb7cc786705c237a14d81231c75a76081b93184a10","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/706fd5933926a56babac5b7ab1078d8ef5f8e98ee328dd41230817a9b45e798d"}
{"level":"debug","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/337fb4f9a0608cd0f60a50bb7cc786705c237a14d81231c75a76081b93184a10"}
{"level":"info","ts":"2026-07-06T01:58:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51822","PortSpecifier":{"PortValue":51822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"500b6917-4f71-46a3-9b02-2b8f324968c5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51822","PortSpecifier":{"PortValue":51822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303129,"nanos":203291272},"http":{"id":"500b6917-4f71-46a3-9b02-2b8f324968c5","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"]}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7260d6ca721808c5970414fc1ed81eea03d8e9b82bb9b358231605549e6b86dc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"500b6917-4f71-46a3-9b02-2b8f324968c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49480","PortSpecifier":{"PortValue":49480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"88640072-f8a8-4593-bc51-129cfcbd23d2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49480","PortSpecifier":{"PortValue":49480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303129,"nanos":238415273},"http":{"id":"88640072-f8a8-4593-bc51-129cfcbd23d2","method":"POST","headers":{":authority":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"]}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ca26ca792309619dd45f7dc6b8e6737264ad19acfe94e2d09c0e81c803609dc1"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88640072-f8a8-4593-bc51-129cfcbd23d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51826","PortSpecifier":{"PortValue":51826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51826","PortSpecifier":{"PortValue":51826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303129,"nanos":273068457},"http":{"id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU\"}"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","subscription":"e2e-rate-iso-a-9ef0ac","tenant":"e2e-shared-a-5afb9c","userId":"faf48135-4837-4fb9-bed9-ffa257804f8f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-9ef0ac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9ef0ac"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","selected_subscription":"e2e-rate-iso-a-9ef0ac","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-9ef0ac@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:58:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6cf8e55-2559-447f-bfd0-1c21b251a5d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51832","PortSpecifier":{"PortValue":51832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51832","PortSpecifier":{"PortValue":51832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303130,"nanos":318264650},"http":{"id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU\"}"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","subscription":"e2e-rate-iso-a-9ef0ac","tenant":"e2e-shared-a-5afb9c","userId":"faf48135-4837-4fb9-bed9-ffa257804f8f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-9ef0ac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9ef0ac"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","selected_subscription":"e2e-rate-iso-a-9ef0ac","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-9ef0ac@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:58:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ca9b54f-fc40-42f7-8cd2-80ef14b8f4a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51840","PortSpecifier":{"PortValue":51840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:51840","PortSpecifier":{"PortValue":51840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303131,"nanos":354199448},"http":{"id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RPBx6GM6et12eFvj_T2cyjjBoDRccIJ8MYd2r5YaXX6YFsM3rIGuX0xGxFbU\"}"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","subscription":"e2e-rate-iso-a-9ef0ac","tenant":"e2e-shared-a-5afb9c","userId":"faf48135-4837-4fb9-bed9-ffa257804f8f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-9ef0ac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9ef0ac"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"faf48135-4837-4fb9-bed9-ffa257804f8f","keyName":"e2e-rate-a-9ef0ac","selected_subscription":"e2e-rate-iso-a-9ef0ac","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-9ef0ac@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9ef0ac","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:58:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ede08eb-1934-47fd-8a15-ea4f9c5edbb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34074","PortSpecifier":{"PortValue":34074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cc37b91-08f9-47db-96f2-fd0052442918","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34074","PortSpecifier":{"PortValue":34074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303140,"nanos":37128641},"http":{"id":"2cc37b91-08f9-47db-96f2-fd0052442918","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"]}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7260d6ca721808c5970414fc1ed81eea03d8e9b82bb9b358231605549e6b86dc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cc37b91-08f9-47db-96f2-fd0052442918","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35958","PortSpecifier":{"PortValue":35958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fdebb996-d533-44a5-af38-007f21c4d5b9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35958","PortSpecifier":{"PortValue":35958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303140,"nanos":72339925},"http":{"id":"fdebb996-d533-44a5-af38-007f21c4d5b9","method":"POST","headers":{":authority":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"]}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/db271fe5c738"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5d4f7880-1a07-4419-a7ea-5f688803bc86"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5e015c20-4b92-4b1f-844e-1ce2228ec871","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ca26ca792309619dd45f7dc6b8e6737264ad19acfe94e2d09c0e81c803609dc1"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdebb996-d533-44a5-af38-007f21c4d5b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34076","PortSpecifier":{"PortValue":34076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34076","PortSpecifier":{"PortValue":34076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303140,"nanos":106840682},"http":{"id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5abc0df8-bbb1-4518-a5ba-82aed16de5d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34092","PortSpecifier":{"PortValue":34092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34092","PortSpecifier":{"PortValue":34092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303141,"nanos":139560229},"http":{"id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a89d5975-9fc1-46e6-9365-cf94aa9aec27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34098","PortSpecifier":{"PortValue":34098}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34098","PortSpecifier":{"PortValue":34098}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303142,"nanos":172522328},"http":{"id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb8bf2ae-983c-49c5-a135-855b1cce9a71","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34112","PortSpecifier":{"PortValue":34112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"745a4359-085b-4fa9-be2e-aeb3d793637c","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34112","PortSpecifier":{"PortValue":34112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303143,"nanos":210043219},"http":{"id":"745a4359-085b-4fa9-be2e-aeb3d793637c","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745a4359-085b-4fa9-be2e-aeb3d793637c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34114","PortSpecifier":{"PortValue":34114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34114","PortSpecifier":{"PortValue":34114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303144,"nanos":274873499},"http":{"id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1332aa52-8c8f-4cf6-83e9-fa29df0bc03a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34120","PortSpecifier":{"PortValue":34120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34120","PortSpecifier":{"PortValue":34120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303145,"nanos":307899400},"http":{"id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"059214d6-c3f9-4ffd-a659-aaf2cf7eec96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34128","PortSpecifier":{"PortValue":34128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34128","PortSpecifier":{"PortValue":34128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303146,"nanos":347461004},"http":{"id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a324a783-ed3a-4b10-bafe-ff2e20f2c5f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34138","PortSpecifier":{"PortValue":34138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34138","PortSpecifier":{"PortValue":34138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303147,"nanos":383353804},"http":{"id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6ef8f67-ab62-41c6-a76a-6d590c55da33","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34068","PortSpecifier":{"PortValue":34068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff9974e5-300f-4508-a29d-ddf3337b9069","method":"POST","path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions","host":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34068","PortSpecifier":{"PortValue":34068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303148,"nanos":417808272},"http":{"id":"ff9974e5-300f-4508-a29d-ddf3337b9069","method":"POST","headers":{":authority":"e2e-shared-a-5afb9c.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Px210ukW99bLWsMI_GpRxSfZEE5iBlAGhGsaehG109iGsYq5UlrZ8BQ57k67\"}"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","subscription":"e2e-rate-iso-a-bb6d51","tenant":"e2e-shared-a-5afb9c","userId":"1576452c-943b-4f44-8db7-c0a712254685","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\",\"requestedSubscription\":\"e2e-rate-iso-a-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5afb9c.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1576452c-943b-4f44-8db7-c0a712254685","keyName":"e2e-rate-a-bb6d51","selected_subscription":"e2e-rate-iso-a-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-a-5afb9c/e2e-rate-iso-a-bb6d51@ai-tenant-e2e-shared-a-5afb9c/rate-test-model-5afb9c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5afb9c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bb6d51","namespace":"ai-tenant-e2e-shared-a-5afb9c","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff9974e5-300f-4508-a29d-ddf3337b9069","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:55402","PortSpecifier":{"PortValue":55402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","method":"POST","path":"/ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f/v1/completions","host":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:55402","PortSpecifier":{"PortValue":55402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783303148,"nanos":453740348},"http":{"id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","method":"POST","headers":{":authority":"e2e-shared-b-ed9e8f.apps.5bdfb649-4208-4e5f-b70e-db271fe5c738.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jX9MBguCHjibLpI8_diD6luv1ISGXNA6yt80CxmAKvhnOHrP5WsHLG4lFxAr"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-ed9e8f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-jX9MBguCHjibLpI8_diD6luv1ISGXNA6yt80CxmAKvhnOHrP5WsHLG4lFxAr\"}"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ed9e8f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"039c4bcc-5e54-4b6c-8fda-4bbbfa872474","keyName":"e2e-rate-b-bb6d51","subscription":"e2e-rate-iso-b-bb6d51","tenant":"e2e-shared-b-ed9e8f","userId":"039c4bcc-5e54-4b6c-8fda-4bbbfa872474","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-ed9e8f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f\",\"requestedSubscription\":\"e2e-rate-iso-b-bb6d51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ed9e8f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed9e8f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bb6d51","namespace":"ai-tenant-e2e-shared-b-ed9e8f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-bb6d51"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"039c4bcc-5e54-4b6c-8fda-4bbbfa872474","keyName":"e2e-rate-b-bb6d51","selected_subscription":"e2e-rate-iso-b-bb6d51","selected_subscription_key":"ai-tenant-e2e-shared-b-ed9e8f/e2e-rate-iso-b-bb6d51@ai-tenant-e2e-shared-b-ed9e8f/rate-test-model-ed9e8f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed9e8f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bb6d51","namespace":"ai-tenant-e2e-shared-b-ed9e8f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T01:59:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7935c271-1e06-4393-b83e-a7c3acf1c0e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04a3f032a02768111c9c5d08f6ce7e5cc4a1e666c5973e491226ceb378bfcc43"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76d3c3446ffdc7566c49a3522dc3952895c468d9b97221193c2b8d448406dc13"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/34e8283117285addd9618cd1de2806c5b02c31d6973a232913373686d879963f"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f68a636ce276a6fc6d481a517e37d423335d9f87dbd7369439161b3138a7a93"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c255d5732cc9729f58f35b28e2bf8201c0d3f3f1b7cd9e6c3eac1e337f17495"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4526d7c88bcba85c0296e848c16c6a5edcc2e1cfca8df1a325352bada305b360"}
{"level":"info","ts":"2026-07-06T01:59:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd43337ea19013fdedc59573656a43d45d35eb5aff945c14cb18cb827a2c0cf4"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a8f597d6879a7cb000baeb2ba93d4662c0b9e650dba4ad57ee78b0644d0aa5f"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/74c39050c8675fcf9e8aa932034cab64ad5f92536a750e97397d4b8c65bfb516"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7bbdeb02d40232bf7f022709d0320f132b9d429e0d9f067f5215b543e4a22a3"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b92b96f594d0b92cf6c26b05bb0c00bc241778056e27bcf5fc0457ad3aeef4b"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/116a47c36c99c22908c876036b760c7acbde5afc0967c5edfa0b14bf7e3cd894"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/337fb4f9a0608cd0f60a50bb7cc786705c237a14d81231c75a76081b93184a10"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d4322859bcd3aac0fd8d9fc95345073361d4796665e2612484d8e0366e1fae05"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e542a81c59d64d06b4af77f58c7190455efef14ef50d7857f517449e3504cba9"}
{"level":"info","ts":"2026-07-06T01:59:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1209c87f4164685e05d402f073be6d9a253a21d48deb41959a14ea75b044f97d"}
{"level":"info","ts":"2026-07-06T01:59:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/706fd5933926a56babac5b7ab1078d8ef5f8e98ee328dd41230817a9b45e798d"}
{"level":"info","ts":"2026-07-06T01:59:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7260d6ca721808c5970414fc1ed81eea03d8e9b82bb9b358231605549e6b86dc"}
{"level":"info","ts":"2026-07-06T01:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08f85de0717d7b708b35c91f15675cbbdf728cdedd747b1a67c1eedd24b37aee"}
{"level":"info","ts":"2026-07-06T01:59:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ca26ca792309619dd45f7dc6b8e6737264ad19acfe94e2d09c0e81c803609dc1"}