{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:09:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:09:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54"}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49"}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54"}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T17:10:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b"}
{"level":"debug","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d"}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50132","PortSpecifier":{"PortValue":50132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dddecb7c-c941-4a0e-89ae-27f79265885a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50132","PortSpecifier":{"PortValue":50132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049013,"nanos":656196918},"http":{"id":"dddecb7c-c941-4a0e-89ae-27f79265885a","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"]}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dddecb7c-c941-4a0e-89ae-27f79265885a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049013,"nanos":695285022},"http":{"id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","method":"POST","headers":{":authority":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"]}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77295b04-bfb1-40fb-a8bb-2a1df8c1b712","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5472154-a61c-427a-be8d-43407bb6e137","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50136","PortSpecifier":{"PortValue":50136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5472154-a61c-427a-be8d-43407bb6e137","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5472154-a61c-427a-be8d-43407bb6e137","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50136","PortSpecifier":{"PortValue":50136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049013,"nanos":736506249},"http":{"id":"d5472154-a61c-427a-be8d-43407bb6e137","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C\"}"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","subscription":"e2e-rate-iso-a-cab975","tenant":"e2e-shared-a-2f2de5","userId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-cab975\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5472154-a61c-427a-be8d-43407bb6e137","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cab975"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5472154-a61c-427a-be8d-43407bb6e137","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","selected_subscription":"e2e-rate-iso-a-cab975","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-cab975@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5472154-a61c-427a-be8d-43407bb6e137","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5472154-a61c-427a-be8d-43407bb6e137","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50144","PortSpecifier":{"PortValue":50144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50144","PortSpecifier":{"PortValue":50144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049014,"nanos":787538527},"http":{"id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C\"}"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","subscription":"e2e-rate-iso-a-cab975","tenant":"e2e-shared-a-2f2de5","userId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-cab975\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cab975"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","selected_subscription":"e2e-rate-iso-a-cab975","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-cab975@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d77f745-3869-45d2-9ed0-80ef57e3140e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50156","PortSpecifier":{"PortValue":50156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23de5857-4cec-4ce6-86e4-70a2c9658330","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50156","PortSpecifier":{"PortValue":50156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049015,"nanos":827316518},"http":{"id":"23de5857-4cec-4ce6-86e4-70a2c9658330","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SXGJXQHxxuwxh4hm_NAIDbqI1VwH01FqlptZnt6bXBljgOngar7u6J7cj02C\"}"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","subscription":"e2e-rate-iso-a-cab975","tenant":"e2e-shared-a-2f2de5","userId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-cab975\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cab975"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"398dbaa3-cceb-4c95-b2e7-e9a3da8af794","keyName":"e2e-rate-a-cab975","selected_subscription":"e2e-rate-iso-a-cab975","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-cab975@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cab975","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23de5857-4cec-4ce6-86e4-70a2c9658330","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50162","PortSpecifier":{"PortValue":50162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44d131b7-08d6-472d-8b45-fa725bafbe39","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50162","PortSpecifier":{"PortValue":50162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049022,"nanos":543621666},"http":{"id":"44d131b7-08d6-472d-8b45-fa725bafbe39","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"]}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44d131b7-08d6-472d-8b45-fa725bafbe39","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049022,"nanos":578325706},"http":{"id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","method":"POST","headers":{":authority":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"]}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5c72f91dbedb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=27612792-04ca-440d-bedf-6676b66373b7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"05ebcb56-9578-497b-a81c-a4ff27ecd837","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50c2ac6b-6019-41ec-bf63-5e48fd1713cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50172","PortSpecifier":{"PortValue":50172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50172","PortSpecifier":{"PortValue":50172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049022,"nanos":614413968},"http":{"id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc43c9e-a7df-4ff4-bf40-5f8665949944","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35596","PortSpecifier":{"PortValue":35596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"630d59c3-2ace-4570-b9ba-f01fc537c979","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35596","PortSpecifier":{"PortValue":35596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049023,"nanos":653508633},"http":{"id":"630d59c3-2ace-4570-b9ba-f01fc537c979","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"630d59c3-2ace-4570-b9ba-f01fc537c979","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35610","PortSpecifier":{"PortValue":35610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35610","PortSpecifier":{"PortValue":35610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049024,"nanos":690168089},"http":{"id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7caaa293-8894-4a4e-8f0c-3544f8a6ae1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35626","PortSpecifier":{"PortValue":35626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35626","PortSpecifier":{"PortValue":35626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049025,"nanos":732762176},"http":{"id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cc7bb61-7ecc-4c76-b160-8c1526ab3c0a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35642","PortSpecifier":{"PortValue":35642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35642","PortSpecifier":{"PortValue":35642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049026,"nanos":768081679},"http":{"id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc532ec3-7702-498b-a50f-8bd314fd1f97","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35652","PortSpecifier":{"PortValue":35652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a9a186e2-d14d-4898-9197-b8b89942778c","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35652","PortSpecifier":{"PortValue":35652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049027,"nanos":800890541},"http":{"id":"a9a186e2-d14d-4898-9197-b8b89942778c","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9a186e2-d14d-4898-9197-b8b89942778c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35654","PortSpecifier":{"PortValue":35654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35654","PortSpecifier":{"PortValue":35654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049028,"nanos":839273681},"http":{"id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00307532-a4ec-4156-b0e0-33fdfa0f49f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35662","PortSpecifier":{"PortValue":35662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35662","PortSpecifier":{"PortValue":35662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049029,"nanos":875651797},"http":{"id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3d08201-34f4-44fd-a2f1-ffd786c7dff3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78172924-0706-43cd-9566-8606e75b2ae4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35666","PortSpecifier":{"PortValue":35666}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78172924-0706-43cd-9566-8606e75b2ae4","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78172924-0706-43cd-9566-8606e75b2ae4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35666","PortSpecifier":{"PortValue":35666}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049030,"nanos":912289312},"http":{"id":"78172924-0706-43cd-9566-8606e75b2ae4","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78172924-0706-43cd-9566-8606e75b2ae4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78172924-0706-43cd-9566-8606e75b2ae4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78172924-0706-43cd-9566-8606e75b2ae4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78172924-0706-43cd-9566-8606e75b2ae4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35670","PortSpecifier":{"PortValue":35670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","method":"POST","path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions","host":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:35670","PortSpecifier":{"PortValue":35670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049031,"nanos":948938712},"http":{"id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","method":"POST","headers":{":authority":"e2e-shared-a-2f2de5.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-P34a2iRcICbCy32e_DWMoaLDleWcC9GMJbBhATRERghuXkxtX5hr8FgS5lkD\"}"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","subscription":"e2e-rate-iso-a-2379b2","tenant":"e2e-shared-a-2f2de5","userId":"37c1bc50-4008-4f2b-874a-638085263a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\",\"requestedSubscription\":\"e2e-rate-iso-a-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"37c1bc50-4008-4f2b-874a-638085263a79","keyName":"e2e-rate-a-2379b2","selected_subscription":"e2e-rate-iso-a-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2f2de5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2379b2","namespace":"ai-tenant-e2e-shared-a-2f2de5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7df27273-a5f6-49d5-965b-dac0ffe4886d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57442","PortSpecifier":{"PortValue":57442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","method":"POST","path":"/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d/v1/completions","host":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57442","PortSpecifier":{"PortValue":57442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784049031,"nanos":980528004},"http":{"id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","method":"POST","headers":{":authority":"e2e-shared-b-21db6d.apps.b663afa2-06d7-46a8-8c12-5c72f91dbedb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EVduft6bQM9gMKyb_kTuEnTHeZtiZYYl2gHOR7Ql2ZjkO0F3tuR1gV4JTtf5"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-21db6d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EVduft6bQM9gMKyb_kTuEnTHeZtiZYYl2gHOR7Ql2ZjkO0F3tuR1gV4JTtf5\"}"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-21db6d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9d1eb3aa-eb10-47ce-8b24-64f567beffa7","keyName":"e2e-rate-b-2379b2","subscription":"e2e-rate-iso-b-2379b2","tenant":"e2e-shared-b-21db6d","userId":"9d1eb3aa-eb10-47ce-8b24-64f567beffa7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-21db6d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\",\"requestedSubscription\":\"e2e-rate-iso-b-2379b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-21db6d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-21db6d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2379b2","namespace":"ai-tenant-e2e-shared-b-21db6d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-2379b2"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9d1eb3aa-eb10-47ce-8b24-64f567beffa7","keyName":"e2e-rate-b-2379b2","selected_subscription":"e2e-rate-iso-b-2379b2","selected_subscription_key":"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-21db6d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2379b2","namespace":"ai-tenant-e2e-shared-b-21db6d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T17:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4316360c-bbf3-46e5-ad00-f862b25aa46e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2"}
{"level":"info","ts":"2026-07-14T17:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54"}
{"level":"info","ts":"2026-07-14T17:10:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7"}
{"level":"info","ts":"2026-07-14T17:10:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee"}
{"level":"info","ts":"2026-07-14T17:10:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869"}
{"level":"info","ts":"2026-07-14T17:11:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d"}
{"level":"info","ts":"2026-07-14T17:11:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49"}